var-201812-0271

Vulnerability from variot

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Perl Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Perl is prone to the following multiple buffer-overflow vulnerabilities because it fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer. 1. An integer-overflow vulnerability 2. A heap-based buffer-overflow vulnerability Attackers can exploit these issues to execute arbitrary code on the affected application. Failed attempts will likely cause a denial-of-service condition. 7) - noarch, x86_64

The following packages have been upgraded to a later upstream version: rh-perl526-perl (5.26.3), rh-perl526-perl-Module-CoreList (5.20181130).

For the stable distribution (stretch), these problems have been fixed in version 5.24.1-3+deb9u5.

We recommend that you upgrade your perl packages. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

===================================================================== Red Hat Security Advisory

Synopsis: Important: perl security update Advisory ID: RHSA-2019:0109-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2019:0109 Issue date: 2019-01-21 CVE Names: CVE-2018-18311 =====================================================================

Summary:

An update for perl is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - noarch, x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) - aarch64, noarch, ppc64le, s390x Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) - aarch64, ppc64le, s390x

Description:

Perl is a high-level programming language that is commonly used for system administration utilities and web programming.

Security Fix(es):

perl: Integer overflow leading to buffer overflow in Perl_my_setenv() (CVE-2018-18311)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank the Perl project for reporting this issue. Upstream acknowledges Jayakrishna Menon as the original reporter. Solution:

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Package List:

Red Hat Enterprise Linux Client (v. 7):

Source: perl-5.16.3-294.el7_6.src.rpm

noarch: perl-CPAN-1.9800-294.el7_6.noarch.rpm perl-ExtUtils-CBuilder-0.28.2.6-294.el7_6.noarch.rpm perl-ExtUtils-Embed-1.30-294.el7_6.noarch.rpm perl-ExtUtils-Install-1.58-294.el7_6.noarch.rpm perl-IO-Zlib-1.10-294.el7_6.noarch.rpm perl-Locale-Maketext-Simple-0.21-294.el7_6.noarch.rpm perl-Module-CoreList-2.76.02-294.el7_6.noarch.rpm perl-Module-Loaded-0.08-294.el7_6.noarch.rpm perl-Object-Accessor-0.42-294.el7_6.noarch.rpm perl-Package-Constants-0.02-294.el7_6.noarch.rpm perl-Pod-Escapes-1.04-294.el7_6.noarch.rpm

x86_64: perl-5.16.3-294.el7_6.x86_64.rpm perl-Time-Piece-1.20.1-294.el7_6.x86_64.rpm perl-core-5.16.3-294.el7_6.x86_64.rpm perl-debuginfo-5.16.3-294.el7_6.i686.rpm perl-debuginfo-5.16.3-294.el7_6.x86_64.rpm perl-devel-5.16.3-294.el7_6.i686.rpm perl-devel-5.16.3-294.el7_6.x86_64.rpm perl-libs-5.16.3-294.el7_6.i686.rpm perl-libs-5.16.3-294.el7_6.x86_64.rpm perl-macros-5.16.3-294.el7_6.x86_64.rpm

Red Hat Enterprise Linux Client Optional (v. 7):

x86_64: perl-debuginfo-5.16.3-294.el7_6.x86_64.rpm perl-tests-5.16.3-294.el7_6.x86_64.rpm

Red Hat Enterprise Linux ComputeNode (v. 7):

Source: perl-5.16.3-294.el7_6.src.rpm

Red Hat Enterprise Linux ComputeNode Optional (v. 7):

x86_64: perl-debuginfo-5.16.3-294.el7_6.x86_64.rpm perl-tests-5.16.3-294.el7_6.x86_64.rpm

Red Hat Enterprise Linux Server (v. 7):

Source: perl-5.16.3-294.el7_6.src.rpm

ppc64: perl-5.16.3-294.el7_6.ppc64.rpm perl-Time-Piece-1.20.1-294.el7_6.ppc64.rpm perl-core-5.16.3-294.el7_6.ppc64.rpm perl-debuginfo-5.16.3-294.el7_6.ppc.rpm perl-debuginfo-5.16.3-294.el7_6.ppc64.rpm perl-devel-5.16.3-294.el7_6.ppc.rpm perl-devel-5.16.3-294.el7_6.ppc64.rpm perl-libs-5.16.3-294.el7_6.ppc.rpm perl-libs-5.16.3-294.el7_6.ppc64.rpm perl-macros-5.16.3-294.el7_6.ppc64.rpm

ppc64le: perl-5.16.3-294.el7_6.ppc64le.rpm perl-Time-Piece-1.20.1-294.el7_6.ppc64le.rpm perl-core-5.16.3-294.el7_6.ppc64le.rpm perl-debuginfo-5.16.3-294.el7_6.ppc64le.rpm perl-devel-5.16.3-294.el7_6.ppc64le.rpm perl-libs-5.16.3-294.el7_6.ppc64le.rpm perl-macros-5.16.3-294.el7_6.ppc64le.rpm

s390x: perl-5.16.3-294.el7_6.s390x.rpm perl-Time-Piece-1.20.1-294.el7_6.s390x.rpm perl-core-5.16.3-294.el7_6.s390x.rpm perl-debuginfo-5.16.3-294.el7_6.s390.rpm perl-debuginfo-5.16.3-294.el7_6.s390x.rpm perl-devel-5.16.3-294.el7_6.s390.rpm perl-devel-5.16.3-294.el7_6.s390x.rpm perl-libs-5.16.3-294.el7_6.s390.rpm perl-libs-5.16.3-294.el7_6.s390x.rpm perl-macros-5.16.3-294.el7_6.s390x.rpm

Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7):

Source: perl-5.16.3-294.el7_6.src.rpm

aarch64: perl-5.16.3-294.el7_6.aarch64.rpm perl-Time-Piece-1.20.1-294.el7_6.aarch64.rpm perl-core-5.16.3-294.el7_6.aarch64.rpm perl-debuginfo-5.16.3-294.el7_6.aarch64.rpm perl-devel-5.16.3-294.el7_6.aarch64.rpm perl-libs-5.16.3-294.el7_6.aarch64.rpm perl-macros-5.16.3-294.el7_6.aarch64.rpm

Red Hat Enterprise Linux Server Optional (v. 7):

ppc64: perl-debuginfo-5.16.3-294.el7_6.ppc64.rpm perl-tests-5.16.3-294.el7_6.ppc64.rpm

ppc64le: perl-debuginfo-5.16.3-294.el7_6.ppc64le.rpm perl-tests-5.16.3-294.el7_6.ppc64le.rpm

s390x: perl-debuginfo-5.16.3-294.el7_6.s390x.rpm perl-tests-5.16.3-294.el7_6.s390x.rpm

x86_64: perl-debuginfo-5.16.3-294.el7_6.x86_64.rpm perl-tests-5.16.3-294.el7_6.x86_64.rpm

Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7):

aarch64: perl-debuginfo-5.16.3-294.el7_6.aarch64.rpm perl-tests-5.16.3-294.el7_6.aarch64.rpm

ppc64le: perl-debuginfo-5.16.3-294.el7_6.ppc64le.rpm perl-tests-5.16.3-294.el7_6.ppc64le.rpm

s390x: perl-debuginfo-5.16.3-294.el7_6.s390x.rpm perl-tests-5.16.3-294.el7_6.s390x.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source: perl-5.16.3-294.el7_6.src.rpm

Red Hat Enterprise Linux Workstation Optional (v. 7):

x86_64: perl-debuginfo-5.16.3-294.el7_6.x86_64.rpm perl-tests-5.16.3-294.el7_6.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

References:

https://access.redhat.com/security/cve/CVE-2018-18311 https://access.redhat.com/security/updates/classification/#important

Contact:

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/

iQIVAwUBXEYC0dzjgjWX9erEAQi+cg//SP5ltkBCVsa86sXT7nP94nQepzxwweEj EC1T/sqSYhSYJcftiJdmcxJk9g4wOns39SNJuvsiiajYarJeIFjUq2TpX/lxL3Qe YrrnZ2esaT+kTDPtCpzBoatZ6uSKZmAVBKmu1bQMmquRt6fbk9F3lWWzfUEfspuU RxfJplbKlejPsAAEUA4URdoC8Jey1cbKgrDOxqOGH1ipZyVsW8jvrrCZxCLKkeRR MyfngBxyTGld78ZoDipSMOInjs50Snh3xp+z4ZxPIpltaEiJHK9mbg5Psqvz8hZY S7RMVK4qPPJwFuPLEKBBNtwFneNotq1Hz4Pj1f2YvjsTv56N+IwudLAdHK8bQBA8 mTRgSNbn8T/22U67d6Pa+T1hL/5xstbOM2Jtj5CD++Oqh84mh8ZhWYFafAdCu/RS RRgSZIg3CCjS7C0y+to1BBNARWJm0ymko9NPVGW5anDvqCZfowbUEOe/t1suXbE9 pMJgi+p5JPJwWgA+PkYgeW60edGu1sobtV84QQtgUAjy6wgby2wHYPgJJVNt8TP8 6JkRCmHhbwjsreDy0v65oNWWwTsgUFzjl+KUk5nwh/JST6w+LjY/CCUTgTNyVQR3 ivFL/VNrTip4RQCASlWILYI95U0h+Fb1hL7xbQ5KevVNwS07MZdFhEcZWDTBj3Iw KtRzQvqVeHM= =kPNu -----END PGP SIGNATURE-----

-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

APPLE-SA-2019-3-25-2 macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra

macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra are now available and addresses the following:

AppleGraphicsControl Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.3 Impact: A malicious application may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2019-8555: Zhiyi Zhang of 360 ESG Codesafe Team, Zhuo Liang and shrek_wzw of Qihoo 360 Nirvan Team

Bom Available for: macOS Mojave 10.14.3 Impact: A malicious application may bypass Gatekeeper checks Description: This issue was addressed with improved handling of file metadata. CVE-2019-6239: Ian Moorhouse and Michael Trimm

CFString Available for: macOS Mojave 10.14.3 Impact: Processing a maliciously crafted string may lead to a denial of service Description: A validation issue was addressed with improved logic. CVE-2019-8516: SWIPS Team of Frifee Inc.

configd Available for: macOS Mojave 10.14.3 Impact: A malicious application may be able to elevate privileges Description: A memory initialization issue was addressed with improved memory handling. CVE-2019-8552: Mohamed Ghannam (@_simo36)

Contacts Available for: macOS Mojave 10.14.3 Impact: A malicious application may be able to elevate privileges Description: A buffer overflow issue was addressed with improved memory handling. CVE-2019-8511: an anonymous researcher

CoreCrypto Available for: macOS Mojave 10.14.3 Impact: A malicious application may be able to elevate privileges Description: A buffer overflow was addressed with improved bounds checking. CVE-2019-8542: an anonymous researcher

DiskArbitration Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.3 Impact: An encrypted volume may be unmounted and remounted by a different user without prompting for the password Description: A logic issue was addressed with improved state management. CVE-2019-8522: Colin Meginnis (@falc420)

FaceTime Available for: macOS Mojave 10.14.3 Impact: A user's video may not be paused in a FaceTime call if they exit the FaceTime app while the call is ringing Description: An issue existed in the pausing of FaceTime video. The issue was resolved with improved logic. CVE-2019-8550: Lauren Guzniczak of Keystone Academy

Feedback Assistant Available for: macOS Mojave 10.14.3 Impact: A malicious application may be able to gain root privileges Description: A race condition was addressed with additional validation. CVE-2019-8565: CodeColorist of Ant-Financial LightYear Labs

Feedback Assistant Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.3 Impact: A malicious application may be able to overwrite arbitrary files Description: This issue was addressed with improved checks. CVE-2019-8521: CodeColorist of Ant-Financial LightYear Labs

file Available for: macOS Mojave 10.14.3 Impact: Processing a maliciously crafted file might disclose user information Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2019-6237: an anonymous researcher

Graphics Drivers Available for: macOS Mojave 10.14.3 Impact: An application may be able to read restricted memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2019-8519: Aleksandr Tarasikov (@astarasikov), Juwei Lin (@panicaII) and Junzhi Lu of Trend Micro Research working with Trend Micro's Zero Day Initiative

iAP Available for: macOS Mojave 10.14.3 Impact: A malicious application may be able to elevate privileges Description: A buffer overflow was addressed with improved bounds checking. CVE-2019-8542: an anonymous researcher

IOGraphics Available for: macOS Mojave 10.14.3 Impact: A Mac may not lock when disconnecting from an external monitor Description: A lock handling issue was addressed with improved lock handling. CVE-2019-8533: an anonymous researcher, James Eagan of Télécom ParisTech, R. Scott Kemp of MIT, Romke van Dijk of Z-CERT

IOHIDFamily Available for: macOS Mojave 10.14.3 Impact: A local user may be able to cause unexpected system termination or read kernel memory Description: A memory corruption issue was addressed with improved state management. CVE-2019-8545: Adam Donenfeld (@doadam) of the Zimperium zLabs Team

IOKit Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.3 Impact: A local user may be able to read kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2019-8504: an anonymous researcher

IOKit SCSI Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2019-8529: Juwei Lin (@panicaII) of Trend Micro

Kernel Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.3 Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A buffer overflow was addressed with improved size validation. CVE-2019-8527: Ned Williamson of Google and derrek (@derrekr6)

Kernel Available for: macOS Sierra 10.12.6, macOS Mojave 10.14.3 Impact: Mounting a maliciously crafted NFS network share may lead to arbitrary code execution with system privileges Description: A buffer overflow was addressed with improved bounds checking. CVE-2019-8508: Dr. Silvio Cesare of InfoSect

Kernel Available for: macOS Mojave 10.14.3 Impact: An application may be able to gain elevated privileges Description: A logic issue was addressed with improved state management. CVE-2019-8514: Samuel Groß of Google Project Zero

Kernel Available for: macOS Sierra 10.12.6, macOS Mojave 10.14.3 Impact: A malicious application may be able to determine kernel memory layout Description: A memory initialization issue was addressed with improved memory handling. CVE-2019-8540: Weibo Wang (@ma1fan) of Qihoo 360 Nirvan Team

Kernel Available for: macOS Mojave 10.14.3 Impact: A local user may be able to read kernel memory Description: A memory corruption issue was addressed with improved memory handling. CVE-2019-7293: Ned Williamson of Google

Kernel Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.3 Impact: A malicious application may be able to determine kernel memory layout Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. CVE-2019-6207: Weibo Wang of Qihoo 360 Nirvan Team (@ma1fan) CVE-2019-8510: Stefan Esser of Antid0te UG

Messages Available for: macOS Mojave 10.14.3 Impact: A local user may be able to view sensitive user information Description: An access issue was addressed with additional sandbox restrictions. CVE-2019-8546: ChiYuan Chang

Notes Available for: macOS Mojave 10.14.3 Impact: A local user may be able to view a user's locked notes Description: An access issue was addressed with improved memory management. CVE-2019-8537: Greg Walker (gregwalker.us)

PackageKit Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.3 Impact: A malicious application may be able to elevate privileges Description: A logic issue was addressed with improved validation. CVE-2019-8561: Jaron Bradley of Crowdstrike

Perl Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.3 Impact: Multiple issues in Perl Description: Multiple issues in Perl were addressed in this update. CVE-2018-12015: Jakub Wilk CVE-2018-18311: Jayakrishna Menon CVE-2018-18313: Eiichi Tsukata

Power Management Available for: macOS Mojave 10.14.3 Impact: A malicious application may be able to execute arbitrary code with system privileges Description: Multiple input validation issues existed in MIG generated code. These issues were addressed with improved validation. CVE-2019-8549: Mohamed Ghannam (@_simo36) of SSD Secure Disclosure (ssd-disclosure.com)

QuartzCore Available for: macOS Mojave 10.14.3 Impact: Processing malicious data may lead to unexpected application termination Description: Multiple memory corruption issues were addressed with improved input validation. CVE-2019-8507: Kai Lu or Fortinet's FortiGuard Labs

Security Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.3 Impact: An application may be able to gain elevated privileges Description: A use after free issue was addressed with improved memory management. CVE-2019-8526: Linus Henze (pinauten.de)

Security Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.3 Impact: A malicious application may be able to read restricted memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2019-8520: Antonio Groza, The UK's National Cyber Security Centre (NCSC)

Siri Available for: macOS Mojave 10.14.3 Impact: A malicious application may be able to initiate a Dictation request without user authorization Description: An API issue existed in the handling of dictation requests. This issue was addressed with improved validation. CVE-2019-8502: Luke Deshotels of North Carolina State University, Jordan Beichler of North Carolina State University, William Enck of North Carolina State University, Costin Carabaș of University POLITEHNICA of Bucharest, and Răzvan Deaconescu of University POLITEHNICA of Bucharest

Time Machine Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.3 Impact: A local user may be able to execute arbitrary shell commands Description: This issue was addressed with improved checks. CVE-2019-8513: CodeColorist of Ant-Financial LightYear Labs

TrueTypeScaler Available for: macOS Mojave 10.14.3 Impact: Processing a maliciously crafted font may result in the disclosure of process memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2019-8517: riusksk of VulWar Corp working with Trend Micro Zero Day Initiative

XPC Available for: macOS Sierra 10.12.6, macOS Mojave 10.14.3 Impact: A malicious application may be able to overwrite arbitrary files Description: This issue was addressed with improved checks. CVE-2019-8530: CodeColorist of Ant-Financial LightYear Labs

Additional recognition

Accounts We would like to acknowledge Milan Stute of Secure Mobile Networking Lab at Technische Universität Darmstadt for their assistance.

Books We would like to acknowledge Yiğit Can YILMAZ (@yilmazcanyigit) for their assistance.

Kernel We would like to acknowledge Brandon Azad of Google Project Zero for their assistance.

Mail We would like to acknowledge Craig Young of Tripwire VERT and Hanno Böck for their assistance.

Time Machine We would like to acknowledge CodeColorist of Ant-Financial LightYear Labs for their assistance.

Installation note:

macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/

Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222

This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE-----

iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlyZWQgpHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3E4zA/9 FvnChJHCmmH34DmCi+LGXO/fatCVVvvSHDWm1+bPjl8CeYcF+zZYACkQKxFoNpDT vyiBJnNveCQEHeBvqSyRF8dfsTf4fr0MrFS1uIQVRPf2St6fZ27vDnC6fg269r0D Eqnz0raFUa3bLUirteRMJwAqdGaVKwsNzM13qP4QEdrB14XkwZA0yQBunltFYU33 iAesKeejDLdhwkjfhmmjTlVPZmnABx2ZCfj2v7TiPxTOjfYbXcN8sY2LDHEOWNaM ucrGBMfGH/ehStXAsIArwcLGOl6SI+6JywWVcm9lG6jUHSeSk9BPF6R4JzGrEHZB sSo87+U8b63KA2GkYecwh6xvE5EchQku/fj0d2zbOlg+T2bMbyc6Al2nefsYnX5p 7BuhdZxqq3m3Gme2qRY0eye6wch1BTHhK+zctrVH2XeMaUpeanopVRI8AD+hZJ1J +9oQX8kSa7hzJYPmohA4Wi/Rp9FpKpgXYNBn1A9DgSAvf+eyfWJX0aZXmQZfn/k7 OLz3EmSKvXv0i67L9g2XYeX7GFBMqf4xWeztKLUYFafu73t1mTxZJICcYeTxebS0 zBJdkOHwP9GxsSonblDgPScQPdW85l0fangn7qqiexCVp4JsCGBc0Wuy1lc+MyzS 1YmrDRhRl4aYOf4UGgtKI6ncvM77Y30ECPV3A6vl+wk= =QV0f -----END PGP SIGNATURE----- . ========================================================================== Ubuntu Security Notice USN-3834-1 December 03, 2018

perl vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

Ubuntu 18.10
Ubuntu 18.04 LTS
Ubuntu 16.04 LTS
Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in Perl.

Software Description: - perl: Practical Extraction and Report Language

Details:

Jayakrishna Menon discovered that Perl incorrectly handled Perl_my_setenv. (CVE-2018-18311)

Eiichi Tsukata discovered that Perl incorrectly handled certain regular expressions. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 18.10. (CVE-2018-18312)

Eiichi Tsukata discovered that Perl incorrectly handled certain regular expressions. An attacker could use this issue to cause Perl to crash, resulting in a denial of service. (CVE-2018-18313)

Jakub Wilk discovered that Perl incorrectly handled certain regular expressions. An attacker could use this issue to cause Perl to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 18.10. (CVE-2018-18314)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 18.10: perl 5.26.2-7ubuntu0.1

Ubuntu 18.04 LTS: perl 5.26.1-6ubuntu0.3

Ubuntu 16.04 LTS: perl 5.22.1-9ubuntu0.6

Ubuntu 14.04 LTS: perl 5.18.2-2ubuntu1.7

In general, a standard system update will make all the necessary changes

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201812-0271",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "web gateway",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "mcafee",
        "version": "7.8.2"
      },
      {
        "model": "snapcenter",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.5"
      },
      {
        "model": "e-series santricity os controller",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "web gateway",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "mcafee",
        "version": "8.0.0"
      },
      {
        "model": "snapdriver",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "9.0"
      },
      {
        "model": "enterprise linux server tus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.6"
      },
      {
        "model": "openshift container platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "3.11"
      },
      {
        "model": "perl",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "perl",
        "version": "5.26.3"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "8.0"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "16.04"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "6.0"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.6"
      },
      {
        "model": "web gateway",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "mcafee",
        "version": "7.8.2.8"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "12.04"
      },
      {
        "model": "web gateway",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "mcafee",
        "version": "8.1.1"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "18.04"
      },
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "29"
      },
      {
        "model": "enterprise linux server aus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.6"
      },
      {
        "model": "perl",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "perl",
        "version": "5.28.1"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.4"
      },
      {
        "model": "enterprise linux desktop",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.0"
      },
      {
        "model": "enterprise linux workstation",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.0"
      },
      {
        "model": "enterprise linux eus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.6"
      },
      {
        "model": "mac os x",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.14.4"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "14.04"
      },
      {
        "model": "perl",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "perl",
        "version": "5.28.0"
      },
      {
        "model": "web gateway",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "mcafee",
        "version": "7.7.2"
      },
      {
        "model": "enterprise linux server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.0"
      },
      {
        "model": "snap creator framework",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "netapp",
        "version": null
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "18.10"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "7.0"
      },
      {
        "model": "web gateway",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "mcafee",
        "version": "7.7.2.21"
      },
      {
        "model": "perl",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "the perl",
        "version": "5.28.x"
      },
      {
        "model": "ubuntu",
        "scope": null,
        "trust": 0.8,
        "vendor": "canonical",
        "version": null
      },
      {
        "model": "gnu/linux",
        "scope": null,
        "trust": 0.8,
        "vendor": "debian",
        "version": null
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "the perl",
        "version": "5.28.1"
      },
      {
        "model": "software collections for rhel",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "0"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "7"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.28"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.26.2"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.26"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.24.3"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.22.1"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.20.2"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.20.1"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.18.2"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.16"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.14"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.12.1"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.12"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.11"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.10"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.9.2"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.8.10"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.8.9"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.8.8"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.8.7"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.8.6"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.8.5"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.8.4"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.8.3"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.8"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.8.2"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.8.1"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.24"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.22"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.20"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.18"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.17.7"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.16.2"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.16.1"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.14.3"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.14.2"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.14.1"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.13.9"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.13.8"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.13.7"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.13.6"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.13.5"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.13.4"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.13.3"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.13.2"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.13.11"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.13.10"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.13.1"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.13.0"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.12.3"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.12.2"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.11.5"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.11.4"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.11.3"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.11.2"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.11.1"
      },
      {
        "model": "perl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.10.1"
      },
      {
        "model": "perl",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.28.1"
      },
      {
        "model": "perl",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "perl",
        "version": "5.26.3"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "106145"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-012765"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-18311"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "5.26.3",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "5.28.1",
                "versionStartIncluding": "5.28.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:e-series_santricity_os_controller:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:snapdriver:-:*:*:*:*:unix:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:7.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:7.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:7.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "10.14.4",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "8.1.1",
                "versionStartIncluding": "8.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "7.8.2.8",
                "versionStartIncluding": "7.8.2",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "7.7.2.21",
                "versionStartIncluding": "7.7.2",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-18311"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Red Hat",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "151001"
      },
      {
        "db": "PACKETSTORM",
        "id": "153965"
      },
      {
        "db": "PACKETSTORM",
        "id": "151000"
      },
      {
        "db": "PACKETSTORM",
        "id": "151248"
      }
    ],
    "trust": 0.4
  },
  "cve": "CVE-2018-18311",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Partial",
            "baseScore": 7.5,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "CVE-2018-18311",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "VHN-128858",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 9.8,
            "baseSeverity": "Critical",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2018-18311",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2018-18311",
            "trust": 1.8,
            "value": "CRITICAL"
          },
          {
            "author": "VULHUB",
            "id": "VHN-128858",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-128858"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-012765"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-18311"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Perl Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Perl is prone to the following multiple buffer-overflow vulnerabilities because it fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer. \n1. An integer-overflow vulnerability\n2. A heap-based buffer-overflow vulnerability\nAttackers can exploit these issues to execute arbitrary code on the affected application. Failed attempts will likely cause a denial-of-service condition. 7) - noarch, x86_64\n\n3. \n\nThe following packages have been upgraded to a later upstream version:\nrh-perl526-perl (5.26.3), rh-perl526-perl-Module-CoreList (5.20181130). \n\nFor the stable distribution (stretch), these problems have been fixed in\nversion 5.24.1-3+deb9u5. \n\nWe recommend that you upgrade your perl packages. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n=====================================================================\n                   Red Hat Security Advisory\n\nSynopsis:          Important: perl security update\nAdvisory ID:       RHSA-2019:0109-01\nProduct:           Red Hat Enterprise Linux\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2019:0109\nIssue date:        2019-01-21\nCVE Names:         CVE-2018-18311 \n=====================================================================\n\n1. Summary:\n\nAn update for perl is now available for Red Hat Enterprise Linux 7. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. Relevant releases/architectures:\n\nRed Hat Enterprise Linux Client (v. 7) - noarch, x86_64\nRed Hat Enterprise Linux Client Optional (v. 7) - x86_64\nRed Hat Enterprise Linux ComputeNode (v. 7) - noarch, x86_64\nRed Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64\nRed Hat Enterprise Linux Server (v. 7) - noarch, ppc64, ppc64le, s390x, x86_64\nRed Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64\nRed Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64\nRed Hat Enterprise Linux Workstation Optional (v. 7) - x86_64\nRed Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) - aarch64, noarch, ppc64le, s390x\nRed Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) - aarch64, ppc64le, s390x\n\n3. Description:\n\nPerl is a high-level programming language that is commonly used for system\nadministration utilities and web programming. \n\nSecurity Fix(es):\n\n* perl: Integer overflow leading to buffer overflow in Perl_my_setenv()\n(CVE-2018-18311)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, and other related information, refer to the CVE page(s) listed in\nthe References section. \n\nRed Hat would like to thank the Perl project for reporting this issue. \nUpstream acknowledges Jayakrishna Menon as the original reporter. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n5. Package List:\n\nRed Hat Enterprise Linux Client (v. 7):\n\nSource:\nperl-5.16.3-294.el7_6.src.rpm\n\nnoarch:\nperl-CPAN-1.9800-294.el7_6.noarch.rpm\nperl-ExtUtils-CBuilder-0.28.2.6-294.el7_6.noarch.rpm\nperl-ExtUtils-Embed-1.30-294.el7_6.noarch.rpm\nperl-ExtUtils-Install-1.58-294.el7_6.noarch.rpm\nperl-IO-Zlib-1.10-294.el7_6.noarch.rpm\nperl-Locale-Maketext-Simple-0.21-294.el7_6.noarch.rpm\nperl-Module-CoreList-2.76.02-294.el7_6.noarch.rpm\nperl-Module-Loaded-0.08-294.el7_6.noarch.rpm\nperl-Object-Accessor-0.42-294.el7_6.noarch.rpm\nperl-Package-Constants-0.02-294.el7_6.noarch.rpm\nperl-Pod-Escapes-1.04-294.el7_6.noarch.rpm\n\nx86_64:\nperl-5.16.3-294.el7_6.x86_64.rpm\nperl-Time-Piece-1.20.1-294.el7_6.x86_64.rpm\nperl-core-5.16.3-294.el7_6.x86_64.rpm\nperl-debuginfo-5.16.3-294.el7_6.i686.rpm\nperl-debuginfo-5.16.3-294.el7_6.x86_64.rpm\nperl-devel-5.16.3-294.el7_6.i686.rpm\nperl-devel-5.16.3-294.el7_6.x86_64.rpm\nperl-libs-5.16.3-294.el7_6.i686.rpm\nperl-libs-5.16.3-294.el7_6.x86_64.rpm\nperl-macros-5.16.3-294.el7_6.x86_64.rpm\n\nRed Hat Enterprise Linux Client Optional (v. 7):\n\nx86_64:\nperl-debuginfo-5.16.3-294.el7_6.x86_64.rpm\nperl-tests-5.16.3-294.el7_6.x86_64.rpm\n\nRed Hat Enterprise Linux ComputeNode (v. 7):\n\nSource:\nperl-5.16.3-294.el7_6.src.rpm\n\nnoarch:\nperl-CPAN-1.9800-294.el7_6.noarch.rpm\nperl-ExtUtils-CBuilder-0.28.2.6-294.el7_6.noarch.rpm\nperl-ExtUtils-Embed-1.30-294.el7_6.noarch.rpm\nperl-ExtUtils-Install-1.58-294.el7_6.noarch.rpm\nperl-IO-Zlib-1.10-294.el7_6.noarch.rpm\nperl-Locale-Maketext-Simple-0.21-294.el7_6.noarch.rpm\nperl-Module-CoreList-2.76.02-294.el7_6.noarch.rpm\nperl-Module-Loaded-0.08-294.el7_6.noarch.rpm\nperl-Object-Accessor-0.42-294.el7_6.noarch.rpm\nperl-Package-Constants-0.02-294.el7_6.noarch.rpm\nperl-Pod-Escapes-1.04-294.el7_6.noarch.rpm\n\nx86_64:\nperl-5.16.3-294.el7_6.x86_64.rpm\nperl-Time-Piece-1.20.1-294.el7_6.x86_64.rpm\nperl-core-5.16.3-294.el7_6.x86_64.rpm\nperl-debuginfo-5.16.3-294.el7_6.i686.rpm\nperl-debuginfo-5.16.3-294.el7_6.x86_64.rpm\nperl-devel-5.16.3-294.el7_6.i686.rpm\nperl-devel-5.16.3-294.el7_6.x86_64.rpm\nperl-libs-5.16.3-294.el7_6.i686.rpm\nperl-libs-5.16.3-294.el7_6.x86_64.rpm\nperl-macros-5.16.3-294.el7_6.x86_64.rpm\n\nRed Hat Enterprise Linux ComputeNode Optional (v. 7):\n\nx86_64:\nperl-debuginfo-5.16.3-294.el7_6.x86_64.rpm\nperl-tests-5.16.3-294.el7_6.x86_64.rpm\n\nRed Hat Enterprise Linux Server (v. 7):\n\nSource:\nperl-5.16.3-294.el7_6.src.rpm\n\nnoarch:\nperl-CPAN-1.9800-294.el7_6.noarch.rpm\nperl-ExtUtils-CBuilder-0.28.2.6-294.el7_6.noarch.rpm\nperl-ExtUtils-Embed-1.30-294.el7_6.noarch.rpm\nperl-ExtUtils-Install-1.58-294.el7_6.noarch.rpm\nperl-IO-Zlib-1.10-294.el7_6.noarch.rpm\nperl-Locale-Maketext-Simple-0.21-294.el7_6.noarch.rpm\nperl-Module-CoreList-2.76.02-294.el7_6.noarch.rpm\nperl-Module-Loaded-0.08-294.el7_6.noarch.rpm\nperl-Object-Accessor-0.42-294.el7_6.noarch.rpm\nperl-Package-Constants-0.02-294.el7_6.noarch.rpm\nperl-Pod-Escapes-1.04-294.el7_6.noarch.rpm\n\nppc64:\nperl-5.16.3-294.el7_6.ppc64.rpm\nperl-Time-Piece-1.20.1-294.el7_6.ppc64.rpm\nperl-core-5.16.3-294.el7_6.ppc64.rpm\nperl-debuginfo-5.16.3-294.el7_6.ppc.rpm\nperl-debuginfo-5.16.3-294.el7_6.ppc64.rpm\nperl-devel-5.16.3-294.el7_6.ppc.rpm\nperl-devel-5.16.3-294.el7_6.ppc64.rpm\nperl-libs-5.16.3-294.el7_6.ppc.rpm\nperl-libs-5.16.3-294.el7_6.ppc64.rpm\nperl-macros-5.16.3-294.el7_6.ppc64.rpm\n\nppc64le:\nperl-5.16.3-294.el7_6.ppc64le.rpm\nperl-Time-Piece-1.20.1-294.el7_6.ppc64le.rpm\nperl-core-5.16.3-294.el7_6.ppc64le.rpm\nperl-debuginfo-5.16.3-294.el7_6.ppc64le.rpm\nperl-devel-5.16.3-294.el7_6.ppc64le.rpm\nperl-libs-5.16.3-294.el7_6.ppc64le.rpm\nperl-macros-5.16.3-294.el7_6.ppc64le.rpm\n\ns390x:\nperl-5.16.3-294.el7_6.s390x.rpm\nperl-Time-Piece-1.20.1-294.el7_6.s390x.rpm\nperl-core-5.16.3-294.el7_6.s390x.rpm\nperl-debuginfo-5.16.3-294.el7_6.s390.rpm\nperl-debuginfo-5.16.3-294.el7_6.s390x.rpm\nperl-devel-5.16.3-294.el7_6.s390.rpm\nperl-devel-5.16.3-294.el7_6.s390x.rpm\nperl-libs-5.16.3-294.el7_6.s390.rpm\nperl-libs-5.16.3-294.el7_6.s390x.rpm\nperl-macros-5.16.3-294.el7_6.s390x.rpm\n\nx86_64:\nperl-5.16.3-294.el7_6.x86_64.rpm\nperl-Time-Piece-1.20.1-294.el7_6.x86_64.rpm\nperl-core-5.16.3-294.el7_6.x86_64.rpm\nperl-debuginfo-5.16.3-294.el7_6.i686.rpm\nperl-debuginfo-5.16.3-294.el7_6.x86_64.rpm\nperl-devel-5.16.3-294.el7_6.i686.rpm\nperl-devel-5.16.3-294.el7_6.x86_64.rpm\nperl-libs-5.16.3-294.el7_6.i686.rpm\nperl-libs-5.16.3-294.el7_6.x86_64.rpm\nperl-macros-5.16.3-294.el7_6.x86_64.rpm\n\nRed Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7):\n\nSource:\nperl-5.16.3-294.el7_6.src.rpm\n\naarch64:\nperl-5.16.3-294.el7_6.aarch64.rpm\nperl-Time-Piece-1.20.1-294.el7_6.aarch64.rpm\nperl-core-5.16.3-294.el7_6.aarch64.rpm\nperl-debuginfo-5.16.3-294.el7_6.aarch64.rpm\nperl-devel-5.16.3-294.el7_6.aarch64.rpm\nperl-libs-5.16.3-294.el7_6.aarch64.rpm\nperl-macros-5.16.3-294.el7_6.aarch64.rpm\n\nnoarch:\nperl-CPAN-1.9800-294.el7_6.noarch.rpm\nperl-ExtUtils-CBuilder-0.28.2.6-294.el7_6.noarch.rpm\nperl-ExtUtils-Embed-1.30-294.el7_6.noarch.rpm\nperl-ExtUtils-Install-1.58-294.el7_6.noarch.rpm\nperl-IO-Zlib-1.10-294.el7_6.noarch.rpm\nperl-Locale-Maketext-Simple-0.21-294.el7_6.noarch.rpm\nperl-Module-CoreList-2.76.02-294.el7_6.noarch.rpm\nperl-Module-Loaded-0.08-294.el7_6.noarch.rpm\nperl-Object-Accessor-0.42-294.el7_6.noarch.rpm\nperl-Package-Constants-0.02-294.el7_6.noarch.rpm\nperl-Pod-Escapes-1.04-294.el7_6.noarch.rpm\n\nppc64le:\nperl-5.16.3-294.el7_6.ppc64le.rpm\nperl-Time-Piece-1.20.1-294.el7_6.ppc64le.rpm\nperl-core-5.16.3-294.el7_6.ppc64le.rpm\nperl-debuginfo-5.16.3-294.el7_6.ppc64le.rpm\nperl-devel-5.16.3-294.el7_6.ppc64le.rpm\nperl-libs-5.16.3-294.el7_6.ppc64le.rpm\nperl-macros-5.16.3-294.el7_6.ppc64le.rpm\n\ns390x:\nperl-5.16.3-294.el7_6.s390x.rpm\nperl-Time-Piece-1.20.1-294.el7_6.s390x.rpm\nperl-core-5.16.3-294.el7_6.s390x.rpm\nperl-debuginfo-5.16.3-294.el7_6.s390.rpm\nperl-debuginfo-5.16.3-294.el7_6.s390x.rpm\nperl-devel-5.16.3-294.el7_6.s390.rpm\nperl-devel-5.16.3-294.el7_6.s390x.rpm\nperl-libs-5.16.3-294.el7_6.s390.rpm\nperl-libs-5.16.3-294.el7_6.s390x.rpm\nperl-macros-5.16.3-294.el7_6.s390x.rpm\n\nRed Hat Enterprise Linux Server Optional (v. 7):\n\nppc64:\nperl-debuginfo-5.16.3-294.el7_6.ppc64.rpm\nperl-tests-5.16.3-294.el7_6.ppc64.rpm\n\nppc64le:\nperl-debuginfo-5.16.3-294.el7_6.ppc64le.rpm\nperl-tests-5.16.3-294.el7_6.ppc64le.rpm\n\ns390x:\nperl-debuginfo-5.16.3-294.el7_6.s390x.rpm\nperl-tests-5.16.3-294.el7_6.s390x.rpm\n\nx86_64:\nperl-debuginfo-5.16.3-294.el7_6.x86_64.rpm\nperl-tests-5.16.3-294.el7_6.x86_64.rpm\n\nRed Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7):\n\naarch64:\nperl-debuginfo-5.16.3-294.el7_6.aarch64.rpm\nperl-tests-5.16.3-294.el7_6.aarch64.rpm\n\nppc64le:\nperl-debuginfo-5.16.3-294.el7_6.ppc64le.rpm\nperl-tests-5.16.3-294.el7_6.ppc64le.rpm\n\ns390x:\nperl-debuginfo-5.16.3-294.el7_6.s390x.rpm\nperl-tests-5.16.3-294.el7_6.s390x.rpm\n\nRed Hat Enterprise Linux Workstation (v. 7):\n\nSource:\nperl-5.16.3-294.el7_6.src.rpm\n\nnoarch:\nperl-CPAN-1.9800-294.el7_6.noarch.rpm\nperl-ExtUtils-CBuilder-0.28.2.6-294.el7_6.noarch.rpm\nperl-ExtUtils-Embed-1.30-294.el7_6.noarch.rpm\nperl-ExtUtils-Install-1.58-294.el7_6.noarch.rpm\nperl-IO-Zlib-1.10-294.el7_6.noarch.rpm\nperl-Locale-Maketext-Simple-0.21-294.el7_6.noarch.rpm\nperl-Module-CoreList-2.76.02-294.el7_6.noarch.rpm\nperl-Module-Loaded-0.08-294.el7_6.noarch.rpm\nperl-Object-Accessor-0.42-294.el7_6.noarch.rpm\nperl-Package-Constants-0.02-294.el7_6.noarch.rpm\nperl-Pod-Escapes-1.04-294.el7_6.noarch.rpm\n\nx86_64:\nperl-5.16.3-294.el7_6.x86_64.rpm\nperl-Time-Piece-1.20.1-294.el7_6.x86_64.rpm\nperl-core-5.16.3-294.el7_6.x86_64.rpm\nperl-debuginfo-5.16.3-294.el7_6.i686.rpm\nperl-debuginfo-5.16.3-294.el7_6.x86_64.rpm\nperl-devel-5.16.3-294.el7_6.i686.rpm\nperl-devel-5.16.3-294.el7_6.x86_64.rpm\nperl-libs-5.16.3-294.el7_6.i686.rpm\nperl-libs-5.16.3-294.el7_6.x86_64.rpm\nperl-macros-5.16.3-294.el7_6.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation Optional (v. 7):\n\nx86_64:\nperl-debuginfo-5.16.3-294.el7_6.x86_64.rpm\nperl-tests-5.16.3-294.el7_6.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2018-18311\nhttps://access.redhat.com/security/updates/classification/#important\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2019 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBXEYC0dzjgjWX9erEAQi+cg//SP5ltkBCVsa86sXT7nP94nQepzxwweEj\nEC1T/sqSYhSYJcftiJdmcxJk9g4wOns39SNJuvsiiajYarJeIFjUq2TpX/lxL3Qe\nYrrnZ2esaT+kTDPtCpzBoatZ6uSKZmAVBKmu1bQMmquRt6fbk9F3lWWzfUEfspuU\nRxfJplbKlejPsAAEUA4URdoC8Jey1cbKgrDOxqOGH1ipZyVsW8jvrrCZxCLKkeRR\nMyfngBxyTGld78ZoDipSMOInjs50Snh3xp+z4ZxPIpltaEiJHK9mbg5Psqvz8hZY\nS7RMVK4qPPJwFuPLEKBBNtwFneNotq1Hz4Pj1f2YvjsTv56N+IwudLAdHK8bQBA8\nmTRgSNbn8T/22U67d6Pa+T1hL/5xstbOM2Jtj5CD++Oqh84mh8ZhWYFafAdCu/RS\nRRgSZIg3CCjS7C0y+to1BBNARWJm0ymko9NPVGW5anDvqCZfowbUEOe/t1suXbE9\npMJgi+p5JPJwWgA+PkYgeW60edGu1sobtV84QQtgUAjy6wgby2wHYPgJJVNt8TP8\n6JkRCmHhbwjsreDy0v65oNWWwTsgUFzjl+KUk5nwh/JST6w+LjY/CCUTgTNyVQR3\nivFL/VNrTip4RQCASlWILYI95U0h+Fb1hL7xbQ5KevVNwS07MZdFhEcZWDTBj3Iw\nKtRzQvqVeHM=\n=kPNu\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-2019-3-25-2 macOS Mojave 10.14.4, Security Update\n2019-002 High Sierra, Security Update 2019-002 Sierra\n\nmacOS Mojave 10.14.4, Security Update 2019-002 High Sierra,\nSecurity Update 2019-002 Sierra are now available and\naddresses the following:\n\nAppleGraphicsControl\nAvailable for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS\nMojave 10.14.3\nImpact: A malicious application may be able to execute arbitrary code\nwith kernel privileges\nDescription: A buffer overflow was addressed with improved size\nvalidation. \nCVE-2019-8555: Zhiyi Zhang of 360 ESG Codesafe Team, Zhuo Liang and\nshrek_wzw of Qihoo 360 Nirvan Team\n\nBom\nAvailable for: macOS Mojave 10.14.3\nImpact: A malicious application may bypass Gatekeeper checks\nDescription: This issue was addressed with improved handling of file\nmetadata. \nCVE-2019-6239: Ian Moorhouse and Michael Trimm\n\nCFString\nAvailable for: macOS Mojave 10.14.3\nImpact: Processing a maliciously crafted string may lead to a denial\nof service\nDescription: A validation issue was addressed with improved logic. \nCVE-2019-8516: SWIPS Team of Frifee Inc. \n\nconfigd\nAvailable for: macOS Mojave 10.14.3\nImpact: A malicious application may be able to elevate privileges\nDescription: A memory initialization issue was addressed with\nimproved memory handling. \nCVE-2019-8552: Mohamed Ghannam (@_simo36)\n\nContacts\nAvailable for: macOS Mojave 10.14.3\nImpact: A malicious application may be able to elevate privileges\nDescription: A buffer overflow issue was addressed with improved\nmemory handling. \nCVE-2019-8511: an anonymous researcher\n\nCoreCrypto\nAvailable for: macOS Mojave 10.14.3\nImpact: A malicious application may be able to elevate privileges\nDescription: A buffer overflow was addressed with improved bounds\nchecking. \nCVE-2019-8542: an anonymous researcher\n\nDiskArbitration\nAvailable for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS\nMojave 10.14.3\nImpact: An encrypted volume may be unmounted and remounted by a\ndifferent user without prompting for the password\nDescription: A logic issue was addressed with improved state\nmanagement. \nCVE-2019-8522: Colin Meginnis (@falc420)\n\nFaceTime\nAvailable for: macOS Mojave 10.14.3\nImpact: A user\u0027s video may not be paused in a FaceTime call if they\nexit the FaceTime app while the call is ringing\nDescription: An issue existed in the pausing of FaceTime video. The\nissue was resolved with improved logic. \nCVE-2019-8550: Lauren Guzniczak of Keystone Academy\n\nFeedback Assistant\nAvailable for: macOS Mojave 10.14.3\nImpact: A malicious application may be able to gain root privileges\nDescription: A race condition was addressed with additional\nvalidation. \nCVE-2019-8565: CodeColorist of Ant-Financial LightYear Labs\n\nFeedback Assistant\nAvailable for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS\nMojave 10.14.3\nImpact: A malicious application may be able to overwrite arbitrary\nfiles\nDescription: This issue was addressed with improved checks. \nCVE-2019-8521: CodeColorist of Ant-Financial LightYear Labs\n\nfile\nAvailable for: macOS Mojave 10.14.3\nImpact: Processing a maliciously crafted file might disclose user\ninformation\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking. \nCVE-2019-6237: an anonymous researcher\n\nGraphics Drivers\nAvailable for: macOS Mojave 10.14.3\nImpact: An application may be able to read restricted memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking. \nCVE-2019-8519: Aleksandr Tarasikov (@astarasikov), Juwei Lin\n(@panicaII) and Junzhi Lu of Trend Micro Research working with Trend\nMicro\u0027s Zero Day Initiative\n\niAP\nAvailable for: macOS Mojave 10.14.3\nImpact: A malicious application may be able to elevate privileges\nDescription: A buffer overflow was addressed with improved bounds\nchecking. \nCVE-2019-8542: an anonymous researcher\n\nIOGraphics\nAvailable for: macOS Mojave 10.14.3\nImpact: A Mac may not lock when disconnecting from an external\nmonitor\nDescription: A lock handling issue was addressed with improved lock\nhandling. \nCVE-2019-8533: an anonymous researcher, James Eagan of T\u00e9l\u00e9com\nParisTech, R. Scott Kemp of MIT, Romke van Dijk of Z-CERT\n\nIOHIDFamily\nAvailable for: macOS Mojave 10.14.3\nImpact: A local user may be able to cause unexpected system\ntermination or read kernel memory\nDescription: A memory corruption issue was addressed with improved\nstate management. \nCVE-2019-8545: Adam Donenfeld (@doadam) of the Zimperium zLabs Team\n\nIOKit\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.3\nImpact: A local user may be able to read kernel memory\nDescription: A memory initialization issue was addressed with\nimproved memory handling. \nCVE-2019-8504: an anonymous researcher\n\nIOKit SCSI\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.3\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A memory corruption issue was addressed with improved\ninput validation. \nCVE-2019-8529: Juwei Lin (@panicaII) of Trend Micro\n\nKernel\nAvailable for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS\nMojave 10.14.3\nImpact: A remote attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A buffer overflow was addressed with improved size\nvalidation. \nCVE-2019-8527: Ned Williamson of Google and derrek (@derrekr6)\n\nKernel\nAvailable for: macOS Sierra 10.12.6, macOS Mojave 10.14.3\nImpact: Mounting a maliciously crafted NFS network share may lead to\narbitrary code execution with system privileges\nDescription: A buffer overflow was addressed with improved bounds\nchecking. \nCVE-2019-8508: Dr. Silvio Cesare of InfoSect\n\nKernel\nAvailable for: macOS Mojave 10.14.3\nImpact: An application may be able to gain elevated privileges\nDescription: A logic issue was addressed with improved state\nmanagement. \nCVE-2019-8514: Samuel Gro\u00df of Google Project Zero\n\nKernel\nAvailable for: macOS Sierra 10.12.6, macOS Mojave 10.14.3\nImpact: A malicious application may be able to determine kernel\nmemory layout\nDescription: A memory initialization issue was addressed with\nimproved memory handling. \nCVE-2019-8540: Weibo Wang (@ma1fan) of Qihoo 360  Nirvan Team\n\nKernel\nAvailable for: macOS Mojave 10.14.3\nImpact: A local user may be able to read kernel memory\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2019-7293: Ned Williamson of Google\n\nKernel\nAvailable for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS\nMojave 10.14.3\nImpact: A malicious application may be able to determine kernel\nmemory layout\nDescription: An out-of-bounds read issue existed that led to the\ndisclosure of kernel memory. This was addressed with improved input\nvalidation. \nCVE-2019-6207: Weibo Wang of Qihoo 360 Nirvan Team (@ma1fan)\nCVE-2019-8510: Stefan Esser of Antid0te UG\n\nMessages\nAvailable for: macOS Mojave 10.14.3\nImpact: A local user may be able to view sensitive user information\nDescription: An access issue was addressed with additional sandbox\nrestrictions. \nCVE-2019-8546: ChiYuan Chang\n\nNotes\nAvailable for: macOS Mojave 10.14.3\nImpact: A local user may be able to view a user\u0027s locked notes\nDescription: An access issue was addressed with improved memory\nmanagement. \nCVE-2019-8537: Greg Walker (gregwalker.us)\n\nPackageKit\nAvailable for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS\nMojave 10.14.3\nImpact: A malicious application may be able to elevate privileges\nDescription: A logic issue was addressed with improved validation. \nCVE-2019-8561: Jaron Bradley of Crowdstrike\n\nPerl\nAvailable for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS\nMojave 10.14.3\nImpact: Multiple issues in Perl\nDescription: Multiple issues in Perl were addressed in this update. \nCVE-2018-12015: Jakub Wilk\nCVE-2018-18311: Jayakrishna Menon\nCVE-2018-18313: Eiichi Tsukata\n\nPower Management\nAvailable for: macOS Mojave 10.14.3\nImpact: A malicious application may be able to execute arbitrary code\nwith system privileges\nDescription: Multiple input validation issues existed in MIG\ngenerated code. These issues were addressed with improved validation. \nCVE-2019-8549: Mohamed Ghannam (@_simo36) of SSD Secure Disclosure\n(ssd-disclosure.com)\n\nQuartzCore\nAvailable for: macOS Mojave 10.14.3\nImpact: Processing malicious data may lead to unexpected application\ntermination\nDescription: Multiple memory corruption issues were addressed with\nimproved input validation. \nCVE-2019-8507: Kai Lu or Fortinet\u0027s FortiGuard Labs\n\nSecurity\nAvailable for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS\nMojave 10.14.3\nImpact: An application may be able to gain elevated privileges\nDescription: A use after free issue was addressed with improved\nmemory management. \nCVE-2019-8526: Linus Henze (pinauten.de)\n\nSecurity\nAvailable for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS\nMojave 10.14.3\nImpact: A malicious application may be able to read restricted memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking. \nCVE-2019-8520: Antonio Groza, The UK\u0027s National Cyber Security Centre\n(NCSC)\n\nSiri\nAvailable for: macOS Mojave 10.14.3\nImpact: A malicious application may be able to initiate a Dictation\nrequest without user authorization\nDescription: An API issue existed in the handling of dictation\nrequests. This issue was addressed with improved validation. \nCVE-2019-8502: Luke Deshotels of North Carolina State University,\nJordan Beichler of North Carolina State University, William Enck of\nNorth Carolina State University, Costin Caraba\u0219 of University\nPOLITEHNICA of Bucharest, and R\u0103zvan Deaconescu of University\nPOLITEHNICA of Bucharest\n\nTime Machine\nAvailable for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS\nMojave 10.14.3\nImpact: A local user may be able to execute arbitrary shell commands\nDescription: This issue was addressed with improved checks. \nCVE-2019-8513: CodeColorist of Ant-Financial LightYear Labs\n\nTrueTypeScaler\nAvailable for: macOS Mojave 10.14.3\nImpact: Processing a maliciously crafted font may result in the\ndisclosure of process memory\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking. \nCVE-2019-8517: riusksk of VulWar Corp working with Trend Micro Zero\nDay Initiative\n\nXPC\nAvailable for: macOS Sierra 10.12.6, macOS Mojave 10.14.3\nImpact: A malicious application may be able to overwrite arbitrary\nfiles\nDescription: This issue was addressed with improved checks. \nCVE-2019-8530: CodeColorist of Ant-Financial LightYear Labs\n\nAdditional recognition\n\nAccounts\nWe would like to acknowledge Milan Stute of Secure Mobile Networking\nLab at Technische Universit\u00e4t Darmstadt for their assistance. \n\nBooks\nWe would like to acknowledge Yi\u011fit Can YILMAZ (@yilmazcanyigit) for\ntheir assistance. \n\nKernel\nWe would like to acknowledge Brandon Azad of Google Project Zero for\ntheir assistance. \n\nMail\nWe would like to acknowledge Craig Young of Tripwire VERT and Hanno\nB\u00f6ck for their assistance. \n\nTime Machine\nWe would like to acknowledge CodeColorist of Ant-Financial LightYear\nLabs for their assistance. \n\nInstallation note:\n\nmacOS Mojave 10.14.4, Security Update 2019-002 High Sierra,\nSecurity Update 2019-002 Sierra may be obtained from the\nMac App Store or Apple\u0027s Software Downloads web site:\nhttps://support.apple.com/downloads/\n\nInformation will also be posted to the Apple Security Updates\nweb site: https://support.apple.com/kb/HT201222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n-----BEGIN PGP SIGNATURE-----\n\niQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlyZWQgpHHByb2R1Y3Qt\nc2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3E4zA/9\nFvnChJHCmmH34DmCi+LGXO/fatCVVvvSHDWm1+bPjl8CeYcF+zZYACkQKxFoNpDT\nvyiBJnNveCQEHeBvqSyRF8dfsTf4fr0MrFS1uIQVRPf2St6fZ27vDnC6fg269r0D\nEqnz0raFUa3bLUirteRMJwAqdGaVKwsNzM13qP4QEdrB14XkwZA0yQBunltFYU33\niAesKeejDLdhwkjfhmmjTlVPZmnABx2ZCfj2v7TiPxTOjfYbXcN8sY2LDHEOWNaM\nucrGBMfGH/ehStXAsIArwcLGOl6SI+6JywWVcm9lG6jUHSeSk9BPF6R4JzGrEHZB\nsSo87+U8b63KA2GkYecwh6xvE5EchQku/fj0d2zbOlg+T2bMbyc6Al2nefsYnX5p\n7BuhdZxqq3m3Gme2qRY0eye6wch1BTHhK+zctrVH2XeMaUpeanopVRI8AD+hZJ1J\n+9oQX8kSa7hzJYPmohA4Wi/Rp9FpKpgXYNBn1A9DgSAvf+eyfWJX0aZXmQZfn/k7\nOLz3EmSKvXv0i67L9g2XYeX7GFBMqf4xWeztKLUYFafu73t1mTxZJICcYeTxebS0\nzBJdkOHwP9GxsSonblDgPScQPdW85l0fangn7qqiexCVp4JsCGBc0Wuy1lc+MyzS\n1YmrDRhRl4aYOf4UGgtKI6ncvM77Y30ECPV3A6vl+wk=\n=QV0f\n-----END PGP SIGNATURE-----\n. ==========================================================================\nUbuntu Security Notice USN-3834-1\nDecember 03, 2018\n\nperl vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 18.10\n- Ubuntu 18.04 LTS\n- Ubuntu 16.04 LTS\n- Ubuntu 14.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in Perl. \n\nSoftware Description:\n- perl: Practical Extraction and Report Language\n\nDetails:\n\nJayakrishna Menon discovered that Perl incorrectly handled Perl_my_setenv. (CVE-2018-18311)\n\nEiichi Tsukata discovered that Perl incorrectly handled certain regular\nexpressions. This\nissue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 18.10. \n(CVE-2018-18312)\n\nEiichi Tsukata discovered that Perl incorrectly handled certain regular\nexpressions. An attacker could use this issue to cause Perl to crash,\nresulting in a denial of service. (CVE-2018-18313)\n\nJakub Wilk discovered that Perl incorrectly handled certain regular\nexpressions. An attacker could use this issue to cause Perl to crash,\nresulting in a denial of service. This issue only affected Ubuntu 16.04\nLTS, Ubuntu 18.04 LTS, and Ubuntu 18.10. (CVE-2018-18314)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 18.10:\n  perl                            5.26.2-7ubuntu0.1\n\nUbuntu 18.04 LTS:\n  perl                            5.26.1-6ubuntu0.3\n\nUbuntu 16.04 LTS:\n  perl                            5.22.1-9ubuntu0.6\n\nUbuntu 14.04 LTS:\n  perl                            5.18.2-2ubuntu1.7\n\nIn general, a standard system update will make all the necessary changes",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-18311"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-012765"
      },
      {
        "db": "BID",
        "id": "106145"
      },
      {
        "db": "VULHUB",
        "id": "VHN-128858"
      },
      {
        "db": "PACKETSTORM",
        "id": "151001"
      },
      {
        "db": "PACKETSTORM",
        "id": "153965"
      },
      {
        "db": "PACKETSTORM",
        "id": "151000"
      },
      {
        "db": "PACKETSTORM",
        "id": "150523"
      },
      {
        "db": "PACKETSTORM",
        "id": "151248"
      },
      {
        "db": "PACKETSTORM",
        "id": "152222"
      },
      {
        "db": "PACKETSTORM",
        "id": "150564"
      }
    ],
    "trust": 2.61
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2018-18311",
        "trust": 2.9
      },
      {
        "db": "BID",
        "id": "106145",
        "trust": 1.4
      },
      {
        "db": "SECTRACK",
        "id": "1042181",
        "trust": 1.1
      },
      {
        "db": "MCAFEE",
        "id": "SB10278",
        "trust": 1.1
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-012765",
        "trust": 0.8
      },
      {
        "db": "PACKETSTORM",
        "id": "151001",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "153965",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "150564",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "151248",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "151000",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "150523",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "150565",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "153652",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "153814",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "154385",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-128858",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "152222",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-128858"
      },
      {
        "db": "BID",
        "id": "106145"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-012765"
      },
      {
        "db": "PACKETSTORM",
        "id": "151001"
      },
      {
        "db": "PACKETSTORM",
        "id": "153965"
      },
      {
        "db": "PACKETSTORM",
        "id": "151000"
      },
      {
        "db": "PACKETSTORM",
        "id": "150523"
      },
      {
        "db": "PACKETSTORM",
        "id": "151248"
      },
      {
        "db": "PACKETSTORM",
        "id": "152222"
      },
      {
        "db": "PACKETSTORM",
        "id": "150564"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-18311"
      }
    ]
  },
  "id": "VAR-201812-0271",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-128858"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-07-23T20:38:14.990000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "DSA-4347",
        "trust": 0.8,
        "url": "https://www.debian.org/security/2018/dsa-4347"
      },
      {
        "title": "Perl_my_setenv(); handle integer wrap",
        "trust": 0.8,
        "url": "https://github.com/perl/perl5/commit/34716e2a6ee2af96078d62b065b7785c001194be"
      },
      {
        "title": "[SECURITY] Fedora 29 Update: perl-5.28.1-425.fc29",
        "trust": 0.8,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/rwqgeb543qn7ssbrkyjm6psoc3rlygsm/"
      },
      {
        "title": "USN-3834-1",
        "trust": 0.8,
        "url": "https://usn.ubuntu.com/3834-1/"
      },
      {
        "title": "USN-3834-2",
        "trust": 0.8,
        "url": "https://usn.ubuntu.com/3834-2/"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-012765"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-190",
        "trust": 1.1
      },
      {
        "problemtype": "CWE-787",
        "trust": 1.1
      },
      {
        "problemtype": "CWE-119",
        "trust": 0.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-128858"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-012765"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-18311"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.2,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1646730"
      },
      {
        "trust": 1.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-18311"
      },
      {
        "trust": 1.4,
        "url": "https://github.com/perl/perl5/commit/34716e2a6ee2af96078d62b065b7785c001194be"
      },
      {
        "trust": 1.2,
        "url": "https://access.redhat.com/errata/rhsa-2019:0001"
      },
      {
        "trust": 1.2,
        "url": "https://access.redhat.com/errata/rhsa-2019:0010"
      },
      {
        "trust": 1.2,
        "url": "https://access.redhat.com/errata/rhsa-2019:0109"
      },
      {
        "trust": 1.2,
        "url": "https://access.redhat.com/errata/rhsa-2019:2400"
      },
      {
        "trust": 1.1,
        "url": "http://www.securityfocus.com/bid/106145"
      },
      {
        "trust": 1.1,
        "url": "https://seclists.org/bugtraq/2019/mar/42"
      },
      {
        "trust": 1.1,
        "url": "https://metacpan.org/changes/release/shay/perl-5.26.3"
      },
      {
        "trust": 1.1,
        "url": "https://metacpan.org/changes/release/shay/perl-5.28.1"
      },
      {
        "trust": 1.1,
        "url": "https://rt.perl.org/ticket/display.html?id=133204"
      },
      {
        "trust": 1.1,
        "url": "https://security.netapp.com/advisory/ntap-20190221-0003/"
      },
      {
        "trust": 1.1,
        "url": "https://support.apple.com/kb/ht209600"
      },
      {
        "trust": 1.1,
        "url": "https://www.debian.org/security/2018/dsa-4347"
      },
      {
        "trust": 1.1,
        "url": "http://seclists.org/fulldisclosure/2019/mar/49"
      },
      {
        "trust": 1.1,
        "url": "https://security.gentoo.org/glsa/201909-01"
      },
      {
        "trust": 1.1,
        "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
      },
      {
        "trust": 1.1,
        "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
      },
      {
        "trust": 1.1,
        "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
      },
      {
        "trust": 1.1,
        "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00039.html"
      },
      {
        "trust": 1.1,
        "url": "https://access.redhat.com/errata/rhba-2019:0327"
      },
      {
        "trust": 1.1,
        "url": "https://access.redhat.com/errata/rhsa-2019:1790"
      },
      {
        "trust": 1.1,
        "url": "https://access.redhat.com/errata/rhsa-2019:1942"
      },
      {
        "trust": 1.1,
        "url": "http://www.securitytracker.com/id/1042181"
      },
      {
        "trust": 1.1,
        "url": "https://usn.ubuntu.com/3834-1/"
      },
      {
        "trust": 1.1,
        "url": "https://usn.ubuntu.com/3834-2/"
      },
      {
        "trust": 1.0,
        "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=sb10278"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/rwqgeb543qn7ssbrkyjm6psoc3rlygsm/"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-18311"
      },
      {
        "trust": 0.7,
        "url": "https://access.redhat.com/security/cve/cve-2018-18311"
      },
      {
        "trust": 0.5,
        "url": "https://access.redhat.com/security/cve/cve-2018-18314"
      },
      {
        "trust": 0.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-18313"
      },
      {
        "trust": 0.4,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-18312"
      },
      {
        "trust": 0.4,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/team/key/"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/articles/11258"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-18314"
      },
      {
        "trust": 0.4,
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "trust": 0.3,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1646751"
      },
      {
        "trust": 0.3,
        "url": "https://github.com/perl/perl5/commit/19a498a461d7c81ae3507c450953d1148efecf4f"
      },
      {
        "trust": 0.3,
        "url": "www.perl.org"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2018-18313"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2018-18312"
      },
      {
        "trust": 0.1,
        "url": "https://kc.mcafee.com/corporate/index?page=content\u0026amp;id=sb10278"
      },
      {
        "trust": 0.1,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/rwqgeb543qn7ssbrkyjm6psoc3rlygsm/"
      },
      {
        "trust": 0.1,
        "url": "https://www.debian.org/security/faq"
      },
      {
        "trust": 0.1,
        "url": "https://www.debian.org/security/"
      },
      {
        "trust": 0.1,
        "url": "https://security-tracker.debian.org/tracker/perl"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-8514"
      },
      {
        "trust": 0.1,
        "url": "https://support.apple.com/kb/ht201222"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-8511"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-8519"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-8502"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-8516"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-6239"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-8522"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-6237"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-8540"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-8526"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-8527"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-12015"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-8533"
      },
      {
        "trust": 0.1,
        "url": "https://support.apple.com/downloads/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-8520"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-8517"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-8521"
      },
      {
        "trust": 0.1,
        "url": "https://www.apple.com/support/security/pgp/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-6207"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-8504"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-7293"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-8510"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-8508"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-8530"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-8513"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-8529"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-8537"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-8507"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/perl/5.26.1-6ubuntu0.3"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/perl/5.22.1-9ubuntu0.6"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/perl/5.18.2-2ubuntu1.7"
      },
      {
        "trust": 0.1,
        "url": "https://usn.ubuntu.com/usn/usn-3834-1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/perl/5.26.2-7ubuntu0.1"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-128858"
      },
      {
        "db": "BID",
        "id": "106145"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-012765"
      },
      {
        "db": "PACKETSTORM",
        "id": "151001"
      },
      {
        "db": "PACKETSTORM",
        "id": "153965"
      },
      {
        "db": "PACKETSTORM",
        "id": "151000"
      },
      {
        "db": "PACKETSTORM",
        "id": "150523"
      },
      {
        "db": "PACKETSTORM",
        "id": "151248"
      },
      {
        "db": "PACKETSTORM",
        "id": "152222"
      },
      {
        "db": "PACKETSTORM",
        "id": "150564"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-18311"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-128858"
      },
      {
        "db": "BID",
        "id": "106145"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-012765"
      },
      {
        "db": "PACKETSTORM",
        "id": "151001"
      },
      {
        "db": "PACKETSTORM",
        "id": "153965"
      },
      {
        "db": "PACKETSTORM",
        "id": "151000"
      },
      {
        "db": "PACKETSTORM",
        "id": "150523"
      },
      {
        "db": "PACKETSTORM",
        "id": "151248"
      },
      {
        "db": "PACKETSTORM",
        "id": "152222"
      },
      {
        "db": "PACKETSTORM",
        "id": "150564"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-18311"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-12-07T00:00:00",
        "db": "VULHUB",
        "id": "VHN-128858"
      },
      {
        "date": "2018-11-29T00:00:00",
        "db": "BID",
        "id": "106145"
      },
      {
        "date": "2019-02-07T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-012765"
      },
      {
        "date": "2019-01-03T02:57:52",
        "db": "PACKETSTORM",
        "id": "151001"
      },
      {
        "date": "2019-08-07T20:08:30",
        "db": "PACKETSTORM",
        "id": "153965"
      },
      {
        "date": "2019-01-03T02:57:21",
        "db": "PACKETSTORM",
        "id": "151000"
      },
      {
        "date": "2018-11-30T15:01:16",
        "db": "PACKETSTORM",
        "id": "150523"
      },
      {
        "date": "2019-01-22T16:02:14",
        "db": "PACKETSTORM",
        "id": "151248"
      },
      {
        "date": "2019-03-26T14:40:53",
        "db": "PACKETSTORM",
        "id": "152222"
      },
      {
        "date": "2018-12-03T21:10:16",
        "db": "PACKETSTORM",
        "id": "150564"
      },
      {
        "date": "2018-12-07T21:29:00.407000",
        "db": "NVD",
        "id": "CVE-2018-18311"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-08-24T00:00:00",
        "db": "VULHUB",
        "id": "VHN-128858"
      },
      {
        "date": "2018-11-29T00:00:00",
        "db": "BID",
        "id": "106145"
      },
      {
        "date": "2019-02-07T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-012765"
      },
      {
        "date": "2023-11-07T02:55:02.103000",
        "db": "NVD",
        "id": "CVE-2018-18311"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "network",
    "sources": [
      {
        "db": "BID",
        "id": "106145"
      }
    ],
    "trust": 0.3
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Perl Buffer error vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-012765"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "overflow",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "151001"
      },
      {
        "db": "PACKETSTORM",
        "id": "153965"
      },
      {
        "db": "PACKETSTORM",
        "id": "151000"
      },
      {
        "db": "PACKETSTORM",
        "id": "151248"
      }
    ],
    "trust": 0.4
  }
}

cve-2018-18311

Vulnerability from cvelistv5

Published

2018-12-07 21:00

Modified

2024-08-05 11:08

Severity ?

Summary

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

References

▼	URL	Tags
	https://lists.debian.org/debian-lts-announce/2018/11/msg00039.html	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2018/dsa-4347	vendor-advisory, x_refsource_DEBIAN
	http://www.securityfocus.com/bid/106145	vdb-entry, x_refsource_BID
	http://www.securitytracker.com/id/1042181	vdb-entry, x_refsource_SECTRACK
	https://access.redhat.com/errata/RHSA-2019:0010	vendor-advisory, x_refsource_REDHAT
	https://usn.ubuntu.com/3834-2/	vendor-advisory, x_refsource_UBUNTU
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM/	vendor-advisory, x_refsource_FEDORA
	https://access.redhat.com/errata/RHSA-2019:0001	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2019:0109	vendor-advisory, x_refsource_REDHAT
	https://usn.ubuntu.com/3834-1/	vendor-advisory, x_refsource_UBUNTU
	https://seclists.org/bugtraq/2019/Mar/42	mailing-list, x_refsource_BUGTRAQ
	http://seclists.org/fulldisclosure/2019/Mar/49	mailing-list, x_refsource_FULLDISC
	https://access.redhat.com/errata/RHBA-2019:0327	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2019:1790	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2019:1942	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2019:2400	vendor-advisory, x_refsource_REDHAT
	https://security.gentoo.org/glsa/201909-01	vendor-advisory, x_refsource_GENTOO
	https://www.oracle.com/security-alerts/cpuapr2020.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html	x_refsource_MISC
	https://support.apple.com/kb/HT209600	x_refsource_CONFIRM
	https://bugzilla.redhat.com/show_bug.cgi?id=1646730	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-20190221-0003/	x_refsource_CONFIRM
	https://metacpan.org/changes/release/SHAY/perl-5.26.3	x_refsource_CONFIRM
	https://metacpan.org/changes/release/SHAY/perl-5.28.1	x_refsource_CONFIRM
	https://rt.perl.org/Ticket/Display.html?id=133204	x_refsource_CONFIRM
	https://github.com/Perl/perl5/commit/34716e2a6ee2af96078d62b065b7785c001194be	x_refsource_CONFIRM
	https://kc.mcafee.com/corporate/index?page=content&id=SB10278	x_refsource_CONFIRM

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:08:21.612Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[debian-lts-announce] 20181130 [SECURITY] [DLA 1601-1] perl security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00039.html"
          },
          {
            "name": "DSA-4347",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4347"
          },
          {
            "name": "106145",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/106145"
          },
          {
            "name": "1042181",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1042181"
          },
          {
            "name": "RHSA-2019:0010",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:0010"
          },
          {
            "name": "USN-3834-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3834-2/"
          },
          {
            "name": "FEDORA-2018-9dbe983805",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM/"
          },
          {
            "name": "RHSA-2019:0001",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:0001"
          },
          {
            "name": "RHSA-2019:0109",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:0109"
          },
          {
            "name": "USN-3834-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3834-1/"
          },
          {
            "name": "20190326 APPLE-SA-2019-3-25-2 macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/Mar/42"
          },
          {
            "name": "20190326 APPLE-SA-2019-3-25-2 macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2019/Mar/49"
          },
          {
            "name": "RHBA-2019:0327",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHBA-2019:0327"
          },
          {
            "name": "RHSA-2019:1790",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1790"
          },
          {
            "name": "RHSA-2019:1942",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1942"
          },
          {
            "name": "RHSA-2019:2400",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2400"
          },
          {
            "name": "GLSA-201909-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201909-01"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.apple.com/kb/HT209600"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1646730"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20190221-0003/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://metacpan.org/changes/release/SHAY/perl-5.26.3"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://metacpan.org/changes/release/SHAY/perl-5.28.1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://rt.perl.org/Ticket/Display.html?id=133204"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/Perl/perl5/commit/34716e2a6ee2af96078d62b065b7785c001194be"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10278"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-11-29T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-07-15T02:22:57",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[debian-lts-announce] 20181130 [SECURITY] [DLA 1601-1] perl security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00039.html"
        },
        {
          "name": "DSA-4347",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4347"
        },
        {
          "name": "106145",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/106145"
        },
        {
          "name": "1042181",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1042181"
        },
        {
          "name": "RHSA-2019:0010",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:0010"
        },
        {
          "name": "USN-3834-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3834-2/"
        },
        {
          "name": "FEDORA-2018-9dbe983805",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM/"
        },
        {
          "name": "RHSA-2019:0001",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:0001"
        },
        {
          "name": "RHSA-2019:0109",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:0109"
        },
        {
          "name": "USN-3834-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3834-1/"
        },
        {
          "name": "20190326 APPLE-SA-2019-3-25-2 macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2019/Mar/42"
        },
        {
          "name": "20190326 APPLE-SA-2019-3-25-2 macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2019/Mar/49"
        },
        {
          "name": "RHBA-2019:0327",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHBA-2019:0327"
        },
        {
          "name": "RHSA-2019:1790",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1790"
        },
        {
          "name": "RHSA-2019:1942",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1942"
        },
        {
          "name": "RHSA-2019:2400",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2400"
        },
        {
          "name": "GLSA-201909-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201909-01"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.apple.com/kb/HT209600"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1646730"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20190221-0003/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://metacpan.org/changes/release/SHAY/perl-5.26.3"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://metacpan.org/changes/release/SHAY/perl-5.28.1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://rt.perl.org/Ticket/Display.html?id=133204"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Perl/perl5/commit/34716e2a6ee2af96078d62b065b7785c001194be"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10278"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-18311",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[debian-lts-announce] 20181130 [SECURITY] [DLA 1601-1] perl security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00039.html"
            },
            {
              "name": "DSA-4347",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4347"
            },
            {
              "name": "106145",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/106145"
            },
            {
              "name": "1042181",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1042181"
            },
            {
              "name": "RHSA-2019:0010",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:0010"
            },
            {
              "name": "USN-3834-2",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3834-2/"
            },
            {
              "name": "FEDORA-2018-9dbe983805",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM/"
            },
            {
              "name": "RHSA-2019:0001",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:0001"
            },
            {
              "name": "RHSA-2019:0109",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:0109"
            },
            {
              "name": "USN-3834-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3834-1/"
            },
            {
              "name": "20190326 APPLE-SA-2019-3-25-2 macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2019/Mar/42"
            },
            {
              "name": "20190326 APPLE-SA-2019-3-25-2 macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2019/Mar/49"
            },
            {
              "name": "RHBA-2019:0327",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHBA-2019:0327"
            },
            {
              "name": "RHSA-2019:1790",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:1790"
            },
            {
              "name": "RHSA-2019:1942",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:1942"
            },
            {
              "name": "RHSA-2019:2400",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2400"
            },
            {
              "name": "GLSA-201909-01",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201909-01"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
            },
            {
              "name": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
            },
            {
              "name": "https://support.apple.com/kb/HT209600",
              "refsource": "CONFIRM",
              "url": "https://support.apple.com/kb/HT209600"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1646730",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1646730"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20190221-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20190221-0003/"
            },
            {
              "name": "https://metacpan.org/changes/release/SHAY/perl-5.26.3",
              "refsource": "CONFIRM",
              "url": "https://metacpan.org/changes/release/SHAY/perl-5.26.3"
            },
            {
              "name": "https://metacpan.org/changes/release/SHAY/perl-5.28.1",
              "refsource": "CONFIRM",
              "url": "https://metacpan.org/changes/release/SHAY/perl-5.28.1"
            },
            {
              "name": "https://rt.perl.org/Ticket/Display.html?id=133204",
              "refsource": "CONFIRM",
              "url": "https://rt.perl.org/Ticket/Display.html?id=133204"
            },
            {
              "name": "https://github.com/Perl/perl5/commit/34716e2a6ee2af96078d62b065b7785c001194be",
              "refsource": "CONFIRM",
              "url": "https://github.com/Perl/perl5/commit/34716e2a6ee2af96078d62b065b7785c001194be"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10278",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10278"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-18311",
    "datePublished": "2018-12-07T21:00:00",
    "dateReserved": "2018-10-14T00:00:00",
    "dateUpdated": "2024-08-05T11:08:21.612Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

var-201812-0271

Vulnerability from variot

perl vulnerabilities

cve-2018-18311

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature