CVE-2015-8853

Published: May 25, 2016Modified: May 6, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by "a\x80."

Affected (2)

Products: Fedoraproject: Fedora · Perl: Perl

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 22

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Perl Perl	Up to 5.23.9

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (26)

http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183592.html

Source: security@debian.org

http://perl5.git.perl.org/perl.git/commitdiff/22b433eff9a1ffa2454e18405a56650f07b385b5

Source: security@debian.org

Vendor Advisory

http://www.openwall.com/lists/oss-security/2016/04/20/5

Source: security@debian.org

http://www.openwall.com/lists/oss-security/2016/04/20/7

Source: security@debian.org

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Source: security@debian.org

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

Source: security@debian.org

http://www.securityfocus.com/bid/86707

Source: security@debian.org

https://bugzilla.redhat.com/show_bug.cgi?id=1329106

Source: security@debian.org

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731

Source: security@debian.org

https://rt.perl.org/Public/Bug/Display.html?id=123562

Source: security@debian.org

https://security.gentoo.org/glsa/201701-75

Source: security@debian.org

https://usn.ubuntu.com/3625-1/

Source: security@debian.org

https://usn.ubuntu.com/3625-2/

Source: security@debian.org

http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183592.html