[security-alerts] FW: [SA27546] Perl Regular Expressions Unicode Data Buffer Overflow

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

>
> TITLE:
> Perl Regular Expressions Unicode Data Buffer Overflow
>
> SECUNIA ADVISORY ID:
> SA27546
>
> VERIFY ADVISORY:
> http://secunia.com/advisories/27546/
>
> CRITICAL:
> Moderately critical
>
> IMPACT:
> DoS, System access
>
> WHERE:
> From remote
>
> SOFTWARE:
> Perl 5.x
> http://secunia.com/product/2647/
>
> DESCRIPTION:
> Tavis Ormandy and Will Drewry have reported a vulnerability in Perl,
> which potentially can be exploited by malicious people to compromise
> a vulnerable system.
>
> The vulnerability is caused due to a boundary error within the
> processing of regular expressions containing Unicode data. This can
> be exploited to cause a buffer overflow via a specially crafted
> regular expression causing a runtime switch to the Unicode character
> scheme.
>
> The vulnerability is reported in version 5.8.8. Other versions may
> also be affected.
>
> SOLUTION:
> Fixed in development version 5.9.5.
>
> PROVIDED AND/OR DISCOVERED BY:
> Red Hat credits Tavis Ormandy and Will Drewry, Google Security Team
>
> ORIGINAL ADVISORY:
> https://bugzilla.redhat.com/show_bug.cgi?id=323571
>