CVE-2017-12837 - Vulnerability Details - OpenCVE

Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write) via a regular expression with a '\N{}' escape and the case-insensitive modifier.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Perl	Perl

Configuration 1 [-]

OR	cpe:2.3:a:perl:perl::::::::
	cpe:2.3:a:perl:perl:5.26.0:::::::*

No data.

References

Link	Providers
http://www.debian.org/security/2017/dsa-3982
http://www.securityfocus.com/bid/100860
https://bugzilla.redhat.com/show_bug.cgi?id=1492091
https://nvd.nist.gov/vuln/detail/CVE-2017-12837
https://perl5.git.perl.org/perl.git/commitdiff/96c83ed78aeea1a0496dd2b2d935869a822dc8a5
https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1
https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1
https://rt.perl.org/Public/Bug/Display.html?id=131582
https://security.netapp.com/advisory/ntap-20180426-0001/
https://www.cve.org/CVERecord?id=CVE-2017-12837
https://www.oracle.com/security-alerts/cpujul2020.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2017-09-19T18:00:00

Updated: 2024-08-05T18:51:06.539Z

Reserved: 2017-08-11T00:00:00

Link: CVE-2017-12837

Vulnrichment

No data.

NVD

Status : Modified

Published: 2017-09-19T18:29:00.167

Modified: 2024-11-21T03:10:16.643

Link: CVE-2017-12837

Redhat

Severity : Low

Publid Date: 2017-09-12T00:00:00Z

Links: CVE-2017-12837 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2017-09-10T00:00:00", "descriptions": [{"lang": "en", "value": "Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write) via a regular expression with a '\\N{}' escape and the case-insensitive modifier."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-07-15T02:22:55", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "DSA-3982", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2017/dsa-3982"}, {"name": "100860", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/100860"}, {"tags": ["x_refsource_MISC"], "url": "https://www.oracle.com/security-alerts/cpujul2020.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://security.netapp.com/advisory/ntap-20180426-0001/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1492091"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://rt.perl.org/Public/Bug/Display.html?id=131582"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://perl5.git.perl.org/perl.git/commitdiff/96c83ed78aeea1a0496dd2b2d935869a822dc8a5"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-12837", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write) via a regular expression with a '\\N{}' escape and the case-insensitive modifier."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "DSA-3982", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2017/dsa-3982"}, {"name": "100860", "refsource": "BID", "url": "http://www.securityfocus.com/bid/100860"}, {"name": "https://www.oracle.com/security-alerts/cpujul2020.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpujul2020.html"}, {"name": "https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1", "refsource": "CONFIRM", "url": "https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1"}, {"name": "https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1", "refsource": "CONFIRM", "url": "https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1"}, {"name": "https://security.netapp.com/advisory/ntap-20180426-0001/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20180426-0001/"}, {"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1492091", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1492091"}, {"name": "https://rt.perl.org/Public/Bug/Display.html?id=131582", "refsource": "CONFIRM", "url": "https://rt.perl.org/Public/Bug/Display.html?id=131582"}, {"name": "https://perl5.git.perl.org/perl.git/commitdiff/96c83ed78aeea1a0496dd2b2d935869a822dc8a5", "refsource": "CONFIRM", "url": "https://perl5.git.perl.org/perl.git/commitdiff/96c83ed78aeea1a0496dd2b2d935869a822dc8a5"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T18:51:06.539Z"}, "title": "CVE Program Container", "references": [{"name": "DSA-3982", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2017/dsa-3982"}, {"name": "100860", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/100860"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.oracle.com/security-alerts/cpujul2020.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://security.netapp.com/advisory/ntap-20180426-0001/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1492091"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://rt.perl.org/Public/Bug/Display.html?id=131582"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://perl5.git.perl.org/perl.git/commitdiff/96c83ed78aeea1a0496dd2b2d935869a822dc8a5"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-12837", "datePublished": "2017-09-19T18:00:00", "dateReserved": "2017-08-11T00:00:00", "dateUpdated": "2024-08-05T18:51:06.539Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*", "matchCriteriaId": "DB276E2C-622C-45EB-8378-35751366049F", "versionEndIncluding": "5.24.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:perl:perl:5.26.0:*:*:*:*:*:*:*", "matchCriteriaId": "B71CAECA-2A6A-4604-863F-3C1C055FB1CE", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write) via a regular expression with a '\\N{}' escape and the case-insensitive modifier."}, {"lang": "es", "value": "Un desbordamiento de b\u00fafer en la regi\u00f3n heap de la memoria en la funci\u00f3n S_regatom en el archivo regcomp.c en Perl 5 anterior a versi\u00f3n 5.24.3-RC1 y versi\u00f3n 5.26.x anterior a 5.26.1-RC1, permite a los atacantes remotos causar una denegaci\u00f3n de servicio (escritura fuera de l\u00edmites) por medio de una expresi\u00f3n regular con un escape '\\N{}' y el modificador que no distingue entre may\u00fasculas y min\u00fasculas."}], "id": "CVE-2017-12837", "lastModified": "2024-11-21T03:10:16.643", "metrics": {"cvssMetricV2": [{"acInsufInfo": true, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-09-19T18:29:00.167", "references": [{"source": "cve@mitre.org", "url": "http://www.debian.org/security/2017/dsa-3982"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/100860"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Patch", "Third Party Advisory", "VDB Entry"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1492091"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://perl5.git.perl.org/perl.git/commitdiff/96c83ed78aeea1a0496dd2b2d935869a822dc8a5"}, {"source": "cve@mitre.org", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1"}, {"source": "cve@mitre.org", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1"}, {"source": "cve@mitre.org", "url": "https://rt.perl.org/Public/Bug/Display.html?id=131582"}, {"source": "cve@mitre.org", "url": "https://security.netapp.com/advisory/ntap-20180426-0001/"}, {"source": "cve@mitre.org", "url": "https://www.oracle.com/security-alerts/cpujul2020.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2017/dsa-3982"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/100860"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Third Party Advisory", "VDB Entry"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1492091"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://perl5.git.perl.org/perl.git/commitdiff/96c83ed78aeea1a0496dd2b2d935869a822dc8a5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://rt.perl.org/Public/Bug/Display.html?id=131582"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20180426-0001/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.oracle.com/security-alerts/cpujul2020.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "nvd@nist.gov", "type": "Primary"}]}