CVE-2017-12883: Buffer Overflow
Buffer overflow in the SgrokbslashN function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\N{U+...}' escape.
Other sources
For certain types of syntax error in a regular expression pattern, the error message could either contain the contents of a random, possibly large, chunk of memory, or could crash perl.
Upstream patch:
https://perl5.git.perl.org/perl.git/commitdiff/2be4edede4ae226e2eebd4eff28cedd2041f300f
Bug report :
https://rt.perl.org/Public/Bug/Display.html?id=131598
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-12883?
CVE-2017-12883 has a critical severity rating due to its ability to cause denial of service and potential information disclosure.
How do I fix CVE-2017-12883?
To fix CVE-2017-12883, upgrade Perl to version 5.24.3 or later, or to version 5.26.1 or later.
Which versions of Perl are affected by CVE-2017-12883?
Perl versions prior to 5.24.3-RC1 and 5.26.1-RC1 are affected by CVE-2017-12883.
Can CVE-2017-12883 be exploited remotely?
Yes, CVE-2017-12883 can be exploited remotely through crafted regular expressions containing invalid '\N{U+...}' escapes.
What types of issues can CVE-2017-12883 cause?
CVE-2017-12883 can lead to application crashes or disclosure of sensitive information.