An integer underflow flaw was discovered in the way Perl parsed regular expression backreferences. An attacker able to supply a crafted regular expression to a Perl application could possibly use this flaw to crash that application. Reproducer: $ perl -e '/\7777777777/' Segmentation fault Upstream issue: https://rt.perl.org/Public/Bug/Display.html?id=119505 Upstream patch: http://perl5.git.perl.org/perl.git/commitdiff/0c2990d652e985784f095bba4bc356481a66aa06
Created perl tracking bugs for this issue: Affects: fedora-all [bug 1187151]
The code responsible for processing regular expression backreferences in regcomp.c did not properly handle large digit strings. An attacker able to pass specially crafted regular expressions containing large backreferences can exploit this issue to e.g. cause an application crash due to an out-of-bounds read caused by an array indexing error in the S_regmatch() function. It's possible that this flaw may not affect 32bit platforms. SUSE has previously fixed this via http://marc.info/?l=opensuse-commit&m=121933719424130, although this patch is different from the one used Perl upstream. OSS post assigning the CVE: http://www.openwall.com/lists/oss-security/2015/01/27/3
Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.