Data

Tools

Indexes

Applications

Experiments

Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

cpan

perl

cpan

The Perl 5 language interpreter

View on metacpan.org

Security Advisories for perl in cpan

Moderate
6 days ago

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. CPANSA-perl-2026-19487

cpan perl
Moderate
10 days ago

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. CPANSA-perl-2026-15534

cpan perl
about 1 month ago

Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large re... CPANSA-perl-2026-57432

cpan perl
about 1 month ago

Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between... CPANSA-perl-2026-13221

cpan perl
3 months ago

Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than b... CPANSA-perl-2026-8376

cpan perl
5 months ago

Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable... CPANSA-perl-2026-4176

cpan perl
about 1 year ago

Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle ... CPANSA-perl-2025-40909

cpan perl
over 1 year ago

A heap buffer overflow vulnerability was discovered in Perl. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`. $ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}... CPANSA-perl-2024-56406

cpan perl
almost 3 years ago

A crafted regular expression when compiled by perl 5.30.0 through 5.38.0 can cause a one attacker controlled byte buffer overflow in a heap allocated buffer CPANSA-perl-2023-47038

cpan perl
almost 3 years ago

Perl for Windows relies on the system path environment variable to find the shell (cmd.exe). When running an executable which uses Windows Perl interpreter, Perl attempts to find and execute cmd.exe within the operating system. However, due to path sea... CPANSA-perl-2023-47039

cpan perl
almost 3 years ago

In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation. CPANSA-perl-2022-48522

cpan perl
over 3 years ago

In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a property name associated with a \p{...} regular expression construct is mishandled. The earliest affected version is 5.30.0. CPANSA-perl-2023-47100

cpan perl
High
about 6 years ago

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls. CPANSA-perl-2020-12723

cpan perl
High
about 6 years ago

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow. CPANSA-perl-2020-10543

cpan perl
High
about 6 years ago

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection. CPANSA-perl-2020-10878

cpan perl
Critical
over 7 years ago

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations. CPANSA-perl-2018-18311

cpan perl
Critical
over 7 years ago

Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory. CPANSA-perl-2018-18313

cpan perl
Critical
over 7 years ago

Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations. CPANSA-perl-2018-18314

cpan perl
Critical
over 7 years ago

Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations. CPANSA-perl-2018-18312

cpan perl
High
over 8 years ago

An issue was discovered in Perl 5.22 through 5.26. Matching a crafted locale dependent regular expression can cause a heap-based buffer over-read and potentially information disclosure. CPANSA-perl-2018-6798

cpan perl
Critical
over 8 years ago

Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count. CPANSA-perl-2018-6913

cpan perl
Critical
over 8 years ago

An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow, with control over the bytes written. CPANSA-perl-2018-6797

cpan perl
Critical
almost 9 years ago

Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 on Windows allows attackers to execute arbitrary code via a long environment variable. CPANSA-perl-2017-12814

cpan perl
High
almost 9 years ago

Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write) via a regular expression with a '\\N{}' escape and the... CPANSA-perl-2017-12837

cpan perl
Critical
almost 9 years ago

Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expre... CPANSA-perl-2017-12883

cpan perl
Critical
over 9 years ago

The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument. CPANSA-perl-2015-8608

cpan perl
High
about 10 years ago

The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which might allow local users to execute arbitrary code via a Trojan horse library under the current working directory. CPANSA-perl-2016-6185

cpan perl
High
about 10 years ago

The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by "a\x80." CPANSA-perl-2015-8853

cpan perl
High
over 10 years ago

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp. CPANSA-perl-2016-2381

cpan perl
about 11 years ago

Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associate... CPANSA-perl-2013-7422

cpan perl
over 12 years ago

The Perl_reg_numbered_buff_fetch function in Perl 5.10.0, 5.12.0, 5.14.0, and other versions, when running with debugging enabled, allows context-dependent attackers to cause a denial of service (assertion failure and application exit) via crafted inpu... CPANSA-perl-2010-4777

cpan perl
over 13 years ago

The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key. CPANSA-perl-2013-1667

cpan perl
over 13 years ago

The bsd_glob function in the File::Glob module for Perl before 5.14.2 allows context-dependent attackers to cause a denial of service (crash) via a glob expression with the GLOB_ALTDIRFUNC flag, which triggers an uninitialized pointer dereference. CPANSA-File-Glob-2011-2728

cpan perl
over 13 years ago

The bsd_glob function in the File::Glob module for Perl before 5.14.2 allows context-dependent attackers to cause a denial of service (crash) via a glob expression with the GLOB_ALTDIRFUNC flag, which triggers an uninitialized pointer dereference. CPANSA-perl-2011-2728

cpan perl
over 13 years ago

Heap-based buffer overflow in the Perl_repeatcpy function in util.c in Perl 5.12.x before 5.12.5, 5.14.x before 5.14.3, and 5.15.x before 15.15.5 allows context-dependent attackers to cause a denial of service (memory consumption and crash) or possibly... CPANSA-perl-2012-5195

cpan perl
over 15 years ago

Perl 5.10.x allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an ability to inject arguments into a (1) getpeername, (2) readdir, (3) closedir, (4) getsockname, (5) rewinddir,... CPANSA-perl-2011-0761

cpan perl
over 15 years ago

The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-depe... CPANSA-perl-2011-1487

cpan perl
over 16 years ago

Integer overflow in the regular expression engine in Perl 5.8.x allows context-dependent attackers to cause a denial of service (stack consumption and application crash) by matching a crafted regular expression against a long string. CPANSA-perl-2010-1158

cpan perl
almost 17 years ago

Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression match. CPANSA-perl-2009-3626

cpan perl
over 18 years ago

Double free vulnerability in Perl 5.8.8 allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a crafted regular expression containing UTF8 characters. NOTE: this issue might only be present on certain operat... CPANSA-perl-2008-1927

cpan perl
almost 19 years ago

Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in Perl 5.8 allows context-dependent attackers to execute arbitrary code by switching from byte to Unicode (UTF) characters in a regular expression. CPANSA-perl-2007-5116

cpan perl
over 20 years ago

Integer overflow in the format string functionality (Perl_sv_vcatpvfn) in Perl 5.9.2 and 5.8.6 Perl allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via format string specifiers with large values, which causes an integ... CPANSA-perl-2005-3962

cpan perl
over 21 years ago

The PerlIO implementation in Perl 5.8.0, when installed with setuid support (sperl), allows local users to create arbitrary files via the PERLIO_DEBUG variable. CPANSA-perl-2005-0155

cpan perl
over 21 years ago

Buffer overflow in the PerlIO implementation in Perl 5.8.0, when installed with setuid support (sperl), allows local users to execute arbitrary code by setting the PERLIO_DEBUG variable and executing a Perl script whose full pathname contains a long di... CPANSA-perl-2005-0156

cpan perl
over 22 years ago

Perl 5.8.1 on Fedora Core does not properly initialize the random number generator when forking, which makes it easier for attackers to predict random numbers. CPANSA-perl-2003-0900

cpan perl
almost 26 years ago

suidperl (aka sperl) does not properly cleanse the escape sequence "~!" before calling /bin/mail to send an error report, which allows local users to gain privileges by setting the "interactive" environmental variable and calling suidperl with a filena... CPANSA-sperl-2000-0703

cpan perl
over 26 years ago

Perl 5.004_04 and earlier follows symbolic links when running with the -e option, which allows local users to overwrite arbitrary files via a symlink attack on the /tmp/perl-eaXXXXX file. CPANSA-perl-1999-1386

cpan perl
over 27 years ago

suidperl in Linux Perl does not check the nosuid mount option on file systems, allowing local users to gain root access by placing a setuid script in a mountable file system, e.g. a CD-ROM or floppy disk. CPANSA-sperl-1999-0462

cpan perl
about 29 years ago

Buffer overflow in suidperl (sperl), Perl 4.x and 5.x. CPANSA-sperl-1999-0034

cpan perl

Filter by Severity

Critical 9 High 8 Moderate 2