Seguridad-CVE-2024-56406: Perl 5.34, 5.36, 5.38 y 5.40 son vulnerables a un desbordamiento del búfer de montón al transliterarse bytes no ASCII

Message-ID: 
Date: Sun, 13 Apr 2025 15:23:25 +0200
From: Stig Palmquist 
To: oss-security@...ts.openwall.com
Subject: CVE-2024-56406: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a
 heap buffer overflow when transliterating non-ASCII bytes

========================================================================
CVE-2024-56406                                       CPAN Security Group
========================================================================

        CVE ID:  CVE-2024-56406
  Distribution:  perl
      Versions:  from 5.40.0 until 5.40.2
                 from 5.38.0 until 5.38.4
                 from 5.36.0 through 5.36.3
                 from 5.34.0 through 5.34.3

      MetaCPAN:  https://metacpan.org/dist/perl
      VCS Repo:  https://github.com/Perl/perl5/


Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a heap buffer overflow
when transliterating non-ASCII bytes

Description
-----------
A heap buffer overflow vulnerability was discovered in Perl. 

When there are non-ASCII bytes in the left-hand-side of the `tr`
operator, `S_do_trans_invmap` can overflow the destination pointer `d`.

   $ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;' 
   Segmentation fault (core dumped)

It is believed that this vulnerability can enable Denial of Service and
possibly Code Execution attacks on platforms that lack sufficient
defenses.

Problem types
-------------
CWE-122 Heap-based Buffer Overflow
CWE-787 Out-of-bounds Write

Mitigations
-----------
Users should update perl to 5.40.2 or 5.38.4, or apply the upstream
patch provided in the References section.

References
----------
https://github.com/Perl/perl5/commit/87f42aa0e0096e9a346c9672aa3a0bd3bef8c1dd.patch
https://metacpan.org/release/SHAY/perl-5.38.4/changes
https://metacpan.org/release/SHAY/perl-5.40.2/changes

Credits
-------
Nathan Mills, finder



-- 
Stig Palmquist

Impulsado por Blists – Más listas de correo

Por favor mira el

Wiki de seguridad de software de código abiertoque es contraparte de esto
lista de correo.

Confundido sobre listas de correo ¿Y su uso?
Lea sobre listas de correo en Wikipedia
Y mira estos
pautas sobre el formato adecuado de sus mensajes.