https://bugzilla.redhat.com/show_bug.cgi?id=1492093
Bug ID: 1492093 Summary: CVE-2017-12883 perl: Buffer over-read in regular expression parser Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: amaris@redhat.com CC: alexl@redhat.com, caillon+fedoraproject@gmail.com, caolanm@redhat.com, hhorak@redhat.com, iarnell@gmail.com, jorton@redhat.com, jplesnik@redhat.com, kasal@ucw.cz, mbarnes@fastmail.com, perl-devel@lists.fedoraproject.org, perl-maint-list@redhat.com, ppisar@redhat.com, psabata@redhat.com, rc040203@freenet.de, rhughes@redhat.com, sandmann@redhat.com, tcallawa@redhat.com
For certain types of syntax error in a regular expression pattern, the error message could either contain the contents of a random, possibly large, chunk of memory, or could crash perl.
Upstream patch:
https://perl5.git.perl.org/perl.git/commitdiff/2be4edede4ae226e2eebd4eff28ce...
Bug report (not public atm):
https://rt.perl.org/Public/Bug/Display.html?id=131598