10

CVE-2017-20230

Storable versions before 3.05 for Perl has a stack overflow

Storable versions before 3.05 for Perl has a stack overflow.

The retrieve_hook function stored the length of the class name into a signed integer but in read operations treated the length as unsigned. This allowed an attacker to craft data that could trigger the overflow.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nwclark ≫ Storable SwPlatformperl Version < 3.05
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.64% 0.459
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 10 3.9 6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE-121 Stack-based Buffer Overflow

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

https://github.com/Perl/perl5/issues/15831
Issue Tracking
https://github.com/Perl/perl5/commit/a258c17c6937f79529c8319a829310e09cdbd216.patch
Patch
https://metacpan.org/release/RURBAN/Storable-3.05/changes
Release Notes
https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242533.html
Third Party Advisory
https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242703.html
Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/04/21/5
Mailing List