CVE-2023-47038: Perl: write past buffer end via illegal user-defined unicode property
A crafted regular expression when compiled by perl 5.30.0 through 5.38.0 can cause a one attacker controlled byte buffer overflow in a heap allocated buffer.
Other sources
A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.
— NVD
A vulnerability was found in perl. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/perlto a version that resolves this vulnerability.Fixed in 5.30.0-9ubuntu0.5 - Upgrade
Upgrade
ubuntu/perlto a version that resolves this vulnerability.Fixed in 5.34.0-3ubuntu1.3 - Upgrade
Upgrade
ubuntu/perlto a version that resolves this vulnerability.Fixed in 5.36.0-7ubuntu0.23.04.2 - Upgrade
Upgrade
ubuntu/perlto a version that resolves this vulnerability.Fixed in 5.36.0-9ubuntu1.1 - Upgrade
Upgrade
redhat/perlto a version that resolves this vulnerability.Fixed in 5.32.1 - Upgrade
Upgrade
debian/perlto a version that resolves this vulnerability.Fixed in 5.32.1-4+deb11u3Fixed in 5.32.1-4+deb11u4Fixed in 5.36.0-7+deb12u3Fixed in 5.36.0-7+deb12u2Fixed in 5.40.1-6Fixed in 5.40.1-7
Event History
Frequently Asked Questions
What is CVE-2023-47038?
CVE-2023-47038 is a vulnerability that allows an attacker to cause a buffer overflow in a heap-allocated buffer by using a crafted regular expression in Perl versions 5.30.0 through 5.38.0.
What software is affected by CVE-2023-47038?
Perl versions 5.30.0 through 5.38.0 are affected by CVE-2023-47038.
What is the severity of CVE-2023-47038?
The severity of CVE-2023-47038 is not specified in the provided information.
How can I fix CVE-2023-47038?
To fix CVE-2023-47038, you should update your Perl installation to a version that includes the necessary security patches.
Where can I find more information about CVE-2023-47038?
You can find more information about CVE-2023-47038 on the MITRE CVE website, Ubuntu Security Notices, and NIST National Vulnerability Database.