kritisch
CVE-2018-18311
perl: Integer overflow leading to buffer overflow in Perl_my_setenv()
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Photon OS. Niedriger laut Red Hat (hoch), Amazon (hoch), Oracle (hoch), Ubuntu (mittel).
Beschreibung
Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| Photon OS 1.0 | perl | 5.24.1-3.ph1 |
| Photon OS 2.0 | perl | 5.24.1-7.ph2 |
| Photon OS 3.0 | perl | 5.28.0-3.ph3 |
| alpine 3.10 | perl | 5.26.3-r0 |
| alpine 3.11 | perl | 5.26.3-r0 |
| alpine 3.12 | perl | 5.26.3-r0 |
| alpine 3.13 | perl | 5.26.3-r0 |
| alpine 3.14 | perl | 5.26.3-r0 |
| alpine 3.15 | perl | 5.26.3-r0 |
| alpine 3.16 | perl | 5.26.3-r0 |
| alpine 3.17 | perl | 5.26.3-r0 |
| alpine 3.18 | perl | 5.26.3-r0 |
Alle 143 Einträge aus 43 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| Photon OS 1.0 | perl | 5.24.1-3.ph1 |
| Photon OS 2.0 | perl | 5.24.1-7.ph2 |
| Photon OS 3.0 | perl | 5.28.0-3.ph3 |
| alpine 3.10 | perl | 5.26.3-r0 |
| alpine 3.11 | perl | 5.26.3-r0 |
| alpine 3.12 | perl | 5.26.3-r0 |
| alpine 3.13 | perl | 5.26.3-r0 |
| alpine 3.14 | perl | 5.26.3-r0 |
| alpine 3.15 | perl | 5.26.3-r0 |
| alpine 3.16 | perl | 5.26.3-r0 |
| alpine 3.17 | perl | 5.26.3-r0 |
| alpine 3.18 | perl | 5.26.3-r0 |
| alpine 3.19 | perl | 5.26.3-r0 |
| alpine 3.20 | perl | 5.26.3-r0 |
| alpine 3.21 | perl | 5.26.3-r0 |
| alpine 3.22 | perl | 5.26.3-r0 |
| alpine 3.23 | perl | 5.26.3-r0 |
| alpine 3.24 | perl | 5.26.3-r0 |
| alpine 3.6 | perl | 5.24.4-r2 |
| alpine 3.7 | perl | 5.26.3-r0 |
| alpine 3.8 | perl | 5.26.3-r0 |
| alpine 3.9 | perl | 5.26.3-r0 |
| alpine edge | perl | 5.26.3-r0 |
| amazon linux 1 | perl | 4:5.16.3-294.43.amzn1 |
| amazon linux 1 | perl-CPAN | 1.9800-294.43.amzn1 |
| amazon linux 1 | perl-ExtUtils-CBuilder | 1:0.28.2.6-294.43.amzn1 |
| amazon linux 1 | perl-ExtUtils-Embed | 1.30-294.43.amzn1 |
| amazon linux 1 | perl-ExtUtils-Install | 1.58-294.43.amzn1 |
| amazon linux 1 | perl-IO-Zlib | 1:1.10-294.43.amzn1 |
| amazon linux 1 | perl-Locale-Maketext-Simple | 1:0.21-294.43.amzn1 |
| amazon linux 1 | perl-Module-CoreList | 1:2.76.02-294.43.amzn1 |
| amazon linux 1 | perl-Module-Loaded | 1:0.08-294.43.amzn1 |
| amazon linux 1 | perl-Object-Accessor | 1:0.42-294.43.amzn1 |
| amazon linux 1 | perl-Package-Constants | 1:0.02-294.43.amzn1 |
| amazon linux 1 | perl-Pod-Escapes | 1:1.04-294.43.amzn1 |
| amazon linux 1 | perl-Time-Piece | 1.20.1-294.43.amzn1 |
| amazon linux 1 | perl-core | 5.16.3-294.43.amzn1 |
| amazon linux 1 | perl-debuginfo | 4:5.16.3-294.43.amzn1 |
| amazon linux 1 | perl-devel | 4:5.16.3-294.43.amzn1 |
| amazon linux 1 | perl-libs | 4:5.16.3-294.43.amzn1 |
| amazon linux 1 | perl-macros | 4:5.16.3-294.43.amzn1 |
| amazon linux 1 | perl-tests | 4:5.16.3-294.43.amzn1 |
| amazon linux 2 | perl | 4:5.16.3-294.amzn2 |
| amazon linux 2 | perl-CPAN | 1.9800-294.amzn2 |
| amazon linux 2 | perl-ExtUtils-CBuilder | 1:0.28.2.6-294.amzn2 |
| amazon linux 2 | perl-ExtUtils-Embed | 1.30-294.amzn2 |
| amazon linux 2 | perl-ExtUtils-Install | 1.58-294.amzn2 |
| amazon linux 2 | perl-IO-Zlib | 1:1.10-294.amzn2 |
| amazon linux 2 | perl-Locale-Maketext-Simple | 1:0.21-294.amzn2 |
| amazon linux 2 | perl-Module-CoreList | 1:2.76.02-294.amzn2 |
| amazon linux 2 | perl-Module-Loaded | 1:0.08-294.amzn2 |
| amazon linux 2 | perl-Object-Accessor | 1:0.42-294.amzn2 |
| amazon linux 2 | perl-Package-Constants | 1:0.02-294.amzn2 |
| amazon linux 2 | perl-Pod-Escapes | 1:1.04-294.amzn2 |
| amazon linux 2 | perl-Time-Piece | 1.20.1-294.amzn2 |
| amazon linux 2 | perl-core | 5.16.3-294.amzn2 |
| amazon linux 2 | perl-debuginfo | 4:5.16.3-294.amzn2 |
| amazon linux 2 | perl-devel | 4:5.16.3-294.amzn2 |
| amazon linux 2 | perl-libs | 4:5.16.3-294.amzn2 |
| amazon linux 2 | perl-macros | 4:5.16.3-294.amzn2 |
| amazon linux 2 | perl-tests | 4:5.16.3-294.amzn2 |
| debian 11 | perl | 5.28.1-1 |
| debian 12 | perl | 5.28.1-1 |
| debian 13 | perl | 5.28.1-1 |
| debian 14 | perl | 5.28.1-1 |
| debian 8 | perl | 5.20.2-3+deb8u12 |
| debian 9 | perl | 5.24.1-3+deb9u5 |
| echo | perl | 5.28.1-1 |
| Oracle Linux 7 | perl | 4:5.16.3-294.el7_6 |
| Oracle Linux 7 | perl-CPAN | 1.9800-294.el7_6 |
| Oracle Linux 7 | perl-ExtUtils-CBuilder | 1:0.28.2.6-294.el7_6 |
| Oracle Linux 7 | perl-ExtUtils-Embed | 1.30-294.el7_6 |
| Oracle Linux 7 | perl-ExtUtils-Install | 1.58-294.el7_6 |
| Oracle Linux 7 | perl-IO-Zlib | 1:1.10-294.el7_6 |
| Oracle Linux 7 | perl-Locale-Maketext-Simple | 1:0.21-294.el7_6 |
| Oracle Linux 7 | perl-Module-CoreList | 1:2.76.02-294.el7_6 |
| Oracle Linux 7 | perl-Module-Loaded | 1:0.08-294.el7_6 |
| Oracle Linux 7 | perl-Object-Accessor | 1:0.42-294.el7_6 |
| Oracle Linux 7 | perl-Package-Constants | 1:0.02-294.el7_6 |
| Oracle Linux 7 | perl-Pod-Escapes | 1:1.04-294.el7_6 |
| Oracle Linux 7 | perl-Time-Piece | 1.20.1-294.el7_6 |
| Oracle Linux 7 | perl-core | 5.16.3-294.el7_6 |
| Oracle Linux 7 | perl-devel | 4:5.16.3-294.el7_6 |
| Oracle Linux 7 | perl-libs | 4:5.16.3-294.el7_6 |
| Oracle Linux 7 | perl-macros | 4:5.16.3-294.el7_6 |
| Oracle Linux 7 | perl-tests | 4:5.16.3-294.el7_6 |
| Red Hat | perl | kein Fix angegeben |
| Red Hat | perl-Archive-Extract | kein Fix angegeben |
| Red Hat | perl-Archive-Tar | kein Fix angegeben |
| Red Hat | perl-CGI | kein Fix angegeben |
| Red Hat | perl-CPAN | kein Fix angegeben |
| Red Hat | perl-CPANPLUS | kein Fix angegeben |
| Red Hat | perl-Compress-Raw-Bzip2 | kein Fix angegeben |
| Red Hat | perl-Compress-Raw-Zlib | kein Fix angegeben |
| Red Hat | perl-Compress-Zlib | kein Fix angegeben |
| Red Hat | perl-Digest-SHA | kein Fix angegeben |
| Red Hat | perl-ExtUtils-CBuilder | kein Fix angegeben |
| Red Hat | perl-ExtUtils-Embed | kein Fix angegeben |
| Red Hat | perl-ExtUtils-MakeMaker | kein Fix angegeben |
| Red Hat | perl-ExtUtils-ParseXS | kein Fix angegeben |
| Red Hat | perl-File-Fetch | kein Fix angegeben |
| Red Hat | perl-IO-Compress-Base | kein Fix angegeben |
| Red Hat | perl-IO-Compress-Bzip2 | kein Fix angegeben |
| Red Hat | perl-IO-Compress-Zlib | kein Fix angegeben |
| Red Hat | perl-IO-Zlib | kein Fix angegeben |
| Red Hat | perl-IPC-Cmd | kein Fix angegeben |
| Red Hat | perl-Locale-Maketext-Simple | kein Fix angegeben |
| Red Hat | perl-Log-Message | kein Fix angegeben |
| Red Hat | perl-Log-Message-Simple | kein Fix angegeben |
| Red Hat | perl-Module-Build | kein Fix angegeben |
| Red Hat | perl-Module-CoreList | kein Fix angegeben |
| Red Hat | perl-Module-Load | kein Fix angegeben |
| Red Hat | perl-Module-Load-Conditional | kein Fix angegeben |
| Red Hat | perl-Module-Loaded | kein Fix angegeben |
| Red Hat | perl-Module-Pluggable | kein Fix angegeben |
| Red Hat | perl-Object-Accessor | kein Fix angegeben |
| Red Hat | perl-Package-Constants | kein Fix angegeben |
| Red Hat | perl-Params-Check | kein Fix angegeben |
| Red Hat | perl-Parse-CPAN-Meta | kein Fix angegeben |
| Red Hat | perl-Pod-Escapes | kein Fix angegeben |
| Red Hat | perl-Pod-Simple | kein Fix angegeben |
| Red Hat | perl-Term-UI | kein Fix angegeben |
| Red Hat | perl-Test-Harness | kein Fix angegeben |
| Red Hat | perl-Test-Simple | kein Fix angegeben |
| Red Hat | perl-Time-HiRes | kein Fix angegeben |
| Red Hat | perl-Time-Piece | kein Fix angegeben |
| Red Hat | perl-core | kein Fix angegeben |
| Red Hat | perl-devel | kein Fix angegeben |
| Red Hat | perl-libs | kein Fix angegeben |
| Red Hat | perl-parent | kein Fix angegeben |
| Red Hat | perl-suidperl | kein Fix angegeben |
| Red Hat | perl-version | kein Fix angegeben |
| Red Hat | redhat-virtualization-host-image-update | kein Fix angegeben |
| Red Hat | rhvm-appliance | kein Fix angegeben |
| root.io debian 11 | rootio-perl | 5.28.1-1 |
| root.io debian 12 | rootio-perl | 5.28.1-1 |
| ubuntu 14.04 | perl | 5.18.2-2ubuntu1.7 |
| ubuntu 14.04-ESM | perl | 5.18.2-2ubuntu1.7 |
| ubuntu 16.04 | perl | 5.22.1-9ubuntu0.6 |
| ubuntu 16.04-ESM | perl | 5.22.1-9ubuntu0.6 |
| ubuntu 18.04 | perl | 5.26.1-6ubuntu0.3 |
| ubuntu 18.04-ESM | perl | 5.26.1-6ubuntu0.3 |
| ubuntu 18.10 | perl | 5.26.2-7ubuntu0.1 |
Referenzen
- http://seclists.org/fulldisclosure/2019/Mar/49
- http://www.securityfocus.com/bid/106145
- http://www.securitytracker.com/id/1042181
- https://access.redhat.com/errata/RHBA-2019:0327
- https://access.redhat.com/errata/RHSA-2019:0001
- https://access.redhat.com/errata/RHSA-2019:0010
- https://access.redhat.com/errata/RHSA-2019:0109
- https://access.redhat.com/errata/RHSA-2019:1790
Alle 35 Referenzen
- https://access.redhat.com/errata/RHSA-2019:1942
- https://access.redhat.com/errata/RHSA-2019:2400
- https://access.redhat.com/security/cve/CVE-2018-18311
- https://bugzilla.redhat.com/show_bug.cgi?id=1646730
- https://github.com/Perl/perl5/commit/34716e2a6ee2af96078d62b065b7785c001194be
- https://kc.mcafee.com/corporate/index?page=content&id=SB10278
- https://linux.oracle.com/cve/CVE-2018-18311.html
- https://linux.oracle.com/errata/ELSA-2019-0109.html
- https://lists.debian.org/debian-lts-announce/2018/11/msg00039.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM/
- https://metacpan.org/changes/release/SHAY/perl-5.26.3
- https://metacpan.org/changes/release/SHAY/perl-5.28.1
- https://nvd.nist.gov/vuln/detail/CVE-2018-18311
- https://rt.perl.org/Ticket/Display.html?id=133204
- https://seclists.org/bugtraq/2019/Mar/42
- https://security.gentoo.org/glsa/201909-01
- https://security.netapp.com/advisory/ntap-20190221-0003/
- https://support.apple.com/kb/HT209600
- https://ubuntu.com/security/notices/USN-3834-1
- https://ubuntu.com/security/notices/USN-3834-2
- https://usn.ubuntu.com/3834-1/
- https://usn.ubuntu.com/3834-2/
- https://www.cve.org/CVERecord?id=CVE-2018-18311
- https://www.debian.org/security/2018/dsa-4347
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html