CVE-2023-47038: Perl: write past buffer end via illegal user-defined unicode property
A crafted regular expression when compiled by perl 5.30.0 through 5.38.0 can cause a one attacker controlled byte buffer overflow in a heap allocated buffer.
Other sources
A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.
— NVD
A vulnerability was found in perl. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.
— Ubuntu
Perl is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the user-defined Unicode property. By persuading a victim to use specially crafted regular expression to compile, a remote attacker could overflow a buffer and execute arbitrary code on the system.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-47038?
CVE-2023-47038 is a vulnerability that allows an attacker to cause a buffer overflow in a heap-allocated buffer by using a crafted regular expression in Perl versions 5.30.0 through 5.38.0.
What software is affected by CVE-2023-47038?
Perl versions 5.30.0 through 5.38.0 are affected by CVE-2023-47038.
What is the severity of CVE-2023-47038?
The severity of CVE-2023-47038 is not specified in the provided information.
How can I fix CVE-2023-47038?
To fix CVE-2023-47038, you should update your Perl installation to a version that includes the necessary security patches.
Where can I find more information about CVE-2023-47038?
You can find more information about CVE-2023-47038 on the MITRE CVE website, Ubuntu Security Notices, and NIST National Vulnerability Database.