sync/ports
1
0
Fork 0
mirror of https://git.freebsd.org/ports.git synced 2025-04-28 09:36:41 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

security/vuxml: Add perl vulnerability

Browse source 
* CVE-2024-56406
This commit is contained in:
Fernando Apesteguía 2025-04-15 12:59:17 +02:00
parent c199630333
commit f37cc43f3a
1 changed files with 46 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

46
security/vuxml/vuln/2024.xml
View file

@ -1,3 +1,49 @@
<vuln vid="a380f43e-19e5-11f0-9568-b42e991fc52e">
<topic>Perl -- heap buffer overflow when transliterating non-ASCII bytes</topic>
<affects>
<package>
<name>perl5.36</name>
<range><lt>5.36.3</lt></range>
</package>
<package>
<name>perl5.38</name>
<range><lt>5.38.4</lt></range>
</package>
<package>
<name>perl5.40</name>
<range><lt>5.40.2</lt></range>
</package>
<package>
<name>perl5-devel</name>
<range><lt>5.41.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>9b29abf9-4ab0-4765-b253-1875cd9b441e reports:</p>
<blockquote cite="https://github.com/Perl/perl5/commit/87f42aa0e0096e9a346c9672aa3a0bd3bef8c1dd.patch">
<p>A heap buffer overflow vulnerability was discovered in Perl.
When there are non-ASCII bytes in the left-hand-side of the `tr`
operator, `S_do_trans_invmap` can overflow the destination pointer
`d`.
$ perl -e &apos;$_ = &quot;\x{FF}&quot; x 1000000; tr/\xFF/\x{100}/;&apos;
Segmentation fault (core dumped)
It is believed that this vulnerability can enable Denial of
Service and possibly Code Execution attacks on platforms that
lack sufficient defenses.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-56406</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-56406</url>
</references>
<dates>
<discovery>2025-04-13</discovery>
<entry>2025-04-15</entry>
</dates>
</vuln>
<vuln vid="0230343c-1908-11f0-accc-b42e991fc52e">
<topic>gogs -- Multiple vulnerabilities</topic>
<affects>