REDHAT-BUG-580605: Integer Overflow

Published Apr 8, 2010

Updated

Bruce Merry reported: [1] http://bugs.gentoo.org/showbug.cgi?id=313565

an integer overflow, leading to stack overflow in the way Perl regular expression engine processed certain regular expression(s). Remote attacker could use this flaw to cause a denial of service (crash of an application, using the Perl regular expression engine).

Public PoC from [1]: -------------------- perl -e 'if ((("a " x 100000) . "a\n") =~ /\A\S+(?: \S+)\n\z/) {}'

Affected Software

1 affected component

Perl Perl

Event History

Apr 8, 2010

Data Sourced

via Red Hat·03:47 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-580605?

The severity of REDHAT-BUG-580605 is considered high due to the potential for remote attackers to exploit the vulnerability.

How do I fix REDHAT-BUG-580605?

You can fix REDHAT-BUG-580605 by updating to the latest patched version of Perl that addresses the integer overflow issue.

Who reported the vulnerability REDHAT-BUG-580605?

The vulnerability REDHAT-BUG-580605 was reported by Bruce Merry.

What type of vulnerability is REDHAT-BUG-580605?

REDHAT-BUG-580605 is classified as an integer overflow vulnerability leading to a stack overflow in the Perl regular expression engine.

What impact does REDHAT-BUG-580605 have on affected systems?

The impact of REDHAT-BUG-580605 on affected systems includes the potential for remote code execution through crafted regular expressions.