CVE-2011-0761

2011-05-1300:00:00

ubuntu.com

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS

0.017

Percentile

88.0%

JSON

Perl 5.10.x allows context-dependent attackers to cause a denial of service
(NULL pointer dereference and application crash) by leveraging an ability
to inject arguments into a (1) getpeername, (2) readdir, (3) closedir, (4)
getsockname, (5) rewinddir, (6) tell, or (7) telldir function call.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=628817>

Notes

Author	Note
sbeattie	toucan systems advisory has PoC
seth-arnold	ignoring this CVE: flaw requires extremely poorly written software to exploit the problem (allow input to modify the number of arguments to fundamental functions), crashes do not appear to be under argument control. Upstream Perl team does not consider it a security-relevant problem and thus have not prepared any patches.