Bruce Merry reported: [1] http://bugs.gentoo.org/showbug.cgi?id=313565

an integer overflow, leading to stack overflow in the way Perl regular expression engine processed certain regular expression(s). Remote attacker could use this flaw to cause a denial of service (crash of an application, using the Perl regular expression engine).

Public PoC from [1]: -------------------- perl -e 'if ((("a " x 100000) . "a\n") =~ /\A\S+(?: \S+)\n\z/) {}'

Integer overflow in the format string functionality (Perlsvvcatpvfn) in Perl 5.9.2 and 5.8.6 Perl allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via format string specifiers with large values, which causes an integer wrap and leads to a buffer overflow, as demonstrated using format string vulnerabilities in Perl applications.