Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2017-12883

critical

CVE-2017-12883

perl: Buffer over-read in regular expression parser

Published Modified CWE 119
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat6.5CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

Trivy's own label is CRITICAL. Rated critical by NVD, Photon OS. Rated lower by Red Hat (medium), Ubuntu (medium).

Description

Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\N{U+...}' escape.

Affected packages and fixed versions

SourcePackageFixed in
Photon OS 1.0perl5.22.1-5.ph1
Photon OS 2.0perl5.24.1-4.ph2
alpine 3.10perl5.26.1-r0
alpine 3.11perl5.26.1-r0
alpine 3.12perl5.26.1-r0
alpine 3.13perl5.26.1-r0
alpine 3.14perl5.26.1-r0
alpine 3.15perl5.26.1-r0
alpine 3.16perl5.26.1-r0
alpine 3.17perl5.26.1-r0
alpine 3.18perl5.26.1-r0
alpine 3.19perl5.26.1-r0
Show all 68 entries from 40 sources
SourcePackageFixed in
Photon OS 1.0perl5.22.1-5.ph1
Photon OS 2.0perl5.24.1-4.ph2
alpine 3.10perl5.26.1-r0
alpine 3.11perl5.26.1-r0
alpine 3.12perl5.26.1-r0
alpine 3.13perl5.26.1-r0
alpine 3.14perl5.26.1-r0
alpine 3.15perl5.26.1-r0
alpine 3.16perl5.26.1-r0
alpine 3.17perl5.26.1-r0
alpine 3.18perl5.26.1-r0
alpine 3.19perl5.26.1-r0
alpine 3.20perl5.26.1-r0
alpine 3.21perl5.26.1-r0
alpine 3.22perl5.26.1-r0
alpine 3.23perl5.26.1-r0
alpine 3.24perl5.26.1-r0
alpine 3.3perl5.22.3-r0
alpine 3.4perl5.22.3-r0
alpine 3.5perl5.24.3-r0
alpine 3.6perl5.24.3-r0
alpine 3.7perl5.26.1-r0
alpine 3.8perl5.26.1-r0
alpine 3.9perl5.26.1-r0
alpine edgeperl5.26.1-r0
debian 11perl5.26.0-8
debian 12perl5.26.0-8
debian 13perl5.26.0-8
debian 14perl5.26.0-8
debian 8perl5.20.2-3+deb8u9
debian 9perl5.24.1-3+deb9u2
echoperl5.26.0-8
Red Hatrh-perl524-perlno fix listed
Red Hatrh-perl524-perl-Attribute-Handlersno fix listed
Red Hatrh-perl524-perl-Devel-Peekno fix listed
Red Hatrh-perl524-perl-Devel-SelfStubberno fix listed
Red Hatrh-perl524-perl-Errnono fix listed
Red Hatrh-perl524-perl-ExtUtils-Embedno fix listed
Red Hatrh-perl524-perl-ExtUtils-Miniperlno fix listed
Red Hatrh-perl524-perl-IOno fix listed
Red Hatrh-perl524-perl-IO-Zlibno fix listed
Red Hatrh-perl524-perl-Locale-Maketext-Simpleno fix listed
Red Hatrh-perl524-perl-Math-BigInt-FastCalcno fix listed
Red Hatrh-perl524-perl-Math-BigRatno fix listed
Red Hatrh-perl524-perl-Math-Complexno fix listed
Red Hatrh-perl524-perl-Memoizeno fix listed
Red Hatrh-perl524-perl-Module-Loadedno fix listed
Red Hatrh-perl524-perl-Net-Pingno fix listed
Red Hatrh-perl524-perl-Pod-Htmlno fix listed
Red Hatrh-perl524-perl-SelfLoaderno fix listed
Red Hatrh-perl524-perl-Testno fix listed
Red Hatrh-perl524-perl-Time-Pieceno fix listed
Red Hatrh-perl524-perl-bignumno fix listed
Red Hatrh-perl524-perl-coreno fix listed
Red Hatrh-perl524-perl-develno fix listed
Red Hatrh-perl524-perl-libnetcfgno fix listed
Red Hatrh-perl524-perl-libsno fix listed
Red Hatrh-perl524-perl-macrosno fix listed
Red Hatrh-perl524-perl-openno fix listed
Red Hatrh-perl524-perl-testsno fix listed
Red Hatrh-perl524-perl-utilsno fix listed
root.io debian 11rootio-perl5.26.0-8
root.io debian 12rootio-perl5.26.0-8
ubuntu 14.04perl5.18.2-2ubuntu1.3
ubuntu 14.04-ESMperl5.18.2-2ubuntu1.3
ubuntu 16.04perl5.22.1-9ubuntu0.2
ubuntu 16.04-ESMperl5.22.1-9ubuntu0.2
ubuntu 17.04perl5.24.1-2ubuntu1.1

References

All 15 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.