National Cyber Awareness System

Vulnerability Summary for CVE-2007-5116

Overview

Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in Perl 5.8 allows context-dependent attackers to execute arbitrary code by switching from byte to Unicode (UTF) characters in a regular expression.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Technical Alert: TA07-352A

Name: TA07-352A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA07-352A.html

External Source: MANDRIVA

Name: MDKSA-2007:207

Type: Patch Information

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2007:207

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-1813

Hyperlink:https://issues.rpath.com/browse/RPL-1813

External Source: MISC

Name: https://bugzilla.redhat.com/show_bug.cgi?id=378131

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=378131

External Source: MISC

Name: https://bugzilla.redhat.com/show_bug.cgi?id=323571

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=323571

External Source: XF

Name: perl-unicode-bo(38270)

Hyperlink:http://xforce.iss.net/xforce/xfdb/38270

External Source: VUPEN

Name: ADV-2008-0641

Hyperlink:http://www.vupen.com/english/advisories/2008/0641

External Source: VUPEN

Name: ADV-2008-0064

Hyperlink:http://www.vupen.com/english/advisories/2008/0064

External Source: VUPEN

Name: ADV-2007-4255

Hyperlink:http://www.vupen.com/english/advisories/2007/4255

External Source: VUPEN

Name: ADV-2007-4238

Hyperlink:http://www.vupen.com/english/advisories/2007/4238

External Source: VUPEN

Name: ADV-2007-3724

Hyperlink:http://www.vupen.com/english/advisories/2007/3724

External Source: CONFIRM

Name: http://www.vmware.com/security/advisories/VMSA-2008-0001.html

Hyperlink:http://www.vmware.com/security/advisories/VMSA-2008-0001.html

External Source: UBUNTU

Name: USN-552-1

Hyperlink:http://www.ubuntu.com/usn/usn-552-1

External Source: BID

Name: 26350

Hyperlink:http://www.securityfocus.com/bid/26350

External Source: BUGTRAQ

Name: 20080123 UPDATED VMSA-2008-0001.1 Moderate OpenPegasus PAM Authentication Buffer Overflow and updated service console packages

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/486859/100/0/threaded

External Source: BUGTRAQ

Name: 20080108 VMSA-2008-0001 Moderate OpenPegasus PAM Authentication Buffer Overflow and updated service console packages

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/485936/100/0/threaded

External Source: BUGTRAQ

Name: 20071112 FLEA-2007-0069-1 perl

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/483584/100/0/threaded

External Source: BUGTRAQ

Name: 20071110 FLEA-2007-0063-1 perl

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/483563/100/0/threaded

External Source: REDHAT

Name: RHSA-2007:1011

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-1011.html

External Source: REDHAT

Name: RHSA-2007:0966

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0966.html

External Source: OPENPKG

Name: OpenPKG-SA-2007.023

Hyperlink:http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.023.html

External Source: SUSE

Name: SUSE-SR:2007:024

Hyperlink:http://www.novell.com/linux/security/advisories/2007_24_sr.html

External Source: CONFIRM

Name: http://www.ipcop.org/index.php?name=News&file=article&sid=41

Hyperlink:http://www.ipcop.org/index.php?name=News&file=article&sid=41

External Source: GENTOO

Name: GLSA-200711-28

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200711-28.xml

External Source: DEBIAN

Name: DSA-1400

Hyperlink:http://www.debian.org/security/2007/dsa-1400

External Source: AIXAPAR

Name: IZ10244

Hyperlink:http://www-1.ibm.com/support/docview.wss?uid=isg1IZ10244

External Source: AIXAPAR

Name: IZ10220

Hyperlink:http://www-1.ibm.com/support/docview.wss?uid=isg1IZ10220

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2008-014.htm

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2008-014.htm

External Source: SUNALERT

Name: 1018985

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-77-1018985.1-1

External Source: SECTRACK

Name: 1018899

Hyperlink:http://securitytracker.com/id?1018899

External Source: SECUNIA

Name: 31208

Hyperlink:http://secunia.com/advisories/31208

External Source: SECUNIA

Name: 28387

Hyperlink:http://secunia.com/advisories/28387

External Source: SECUNIA

Name: 28368

Hyperlink:http://secunia.com/advisories/28368

External Source: SECUNIA

Name: 28167

Hyperlink:http://secunia.com/advisories/28167

External Source: SECUNIA

Name: 27936

Hyperlink:http://secunia.com/advisories/27936

External Source: SECUNIA

Name: 27756

Hyperlink:http://secunia.com/advisories/27756

External Source: SECUNIA

Name: 27613

Hyperlink:http://secunia.com/advisories/27613

External Source: SECUNIA

Name: 27570

Hyperlink:http://secunia.com/advisories/27570

External Source: SECUNIA

Name: 27548

Hyperlink:http://secunia.com/advisories/27548

External Source: SECUNIA

Name: 27546

Hyperlink:http://secunia.com/advisories/27546

External Source: SECUNIA

Name: 27531

Type: Advisory

Hyperlink:http://secunia.com/advisories/27531

External Source: SECUNIA

Name: 27515

Hyperlink:http://secunia.com/advisories/27515

External Source: SECUNIA

Name: 27479

Hyperlink:http://secunia.com/advisories/27479

External Source: OVAL

Name: oval:org.mitre.oval:def:10669

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10669

External Source: HP

Name: HPSBTU02311

Hyperlink:http://marc.info/?l=bugtraq&m=120352263023774&w=2

External Source: MLIST

Name: [Security-announce] 20080107 VMSA-2008-0001 Moderate OpenPegasus PAM Authentication Buffer Overflow and updated service console packages

Hyperlink:http://lists.vmware.com/pipermail/security-announce/2008/000002.html

External Source: APPLE

Name: APPLE-SA-2007-12-17

Hyperlink:http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html

External Source: CONFIRM

Name: http://docs.info.apple.com/article.html?artnum=307179

Hyperlink:http://docs.info.apple.com/article.html?artnum=307179

External Source: CONFIRM

Name: ftp://aix.software.ibm.com/aix/efixes/security/README

Hyperlink:ftp://aix.software.ibm.com/aix/efixes/security/README

External Source: SUNALERT

Name: 231524

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-66-231524-1

External Source: SUNALERT

Name: 31524

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-31524-1

External Source: SECUNIA

Name: 29074

Hyperlink:http://secunia.com/advisories/29074

External Source: SECUNIA

Name: 28993

Hyperlink:http://secunia.com/advisories/28993

External Source: HP

Name: HPSBTU02311

Hyperlink:http://marc.info/?l=bugtraq&m=120352263023774&w=2

References to Check Content

Identifier:oval:org.mitre.oval:def:10669

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:10669