REDHAT-BUG-2359290: Buffer Overflow
A heap buffer overflow vulnerability was discovered in Perl.
When there are non-ASCII bytes in the left-hand-side of the tr operator, Sdotransinvmap can overflow the destination pointer d.
$ perl -e '$ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;' Segmentation fault (core dumped)
It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2359290?
The severity of REDHAT-BUG-2359290 is considered high due to the potential for a heap buffer overflow.
How do I fix REDHAT-BUG-2359290?
To fix REDHAT-BUG-2359290, update your Perl installation to the latest version that includes the patch addressing this vulnerability.
Which versions of Perl are affected by REDHAT-BUG-2359290?
Perl 5.30.0 is affected by REDHAT-BUG-2359290.
What types of attacks can REDHAT-BUG-2359290 facilitate?
REDHAT-BUG-2359290 can facilitate remote code execution attacks due to the heap buffer overflow.
Is REDHAT-BUG-2359290 related to specific functionality in Perl?
Yes, REDHAT-BUG-2359290 is related to the `tr` operator in Perl when used with non-ASCII bytes.