diff options
| author | Andy Dougherty <doughera@lafayette.edu> | 2012-09-27 09:52:18 -0400 |
|---|---|---|
| committer | Ricardo Signes <rjbs@cpan.org> | 2012-10-17 11:47:58 -0400 |
| commit | 2709980d5a193ce6f3a16f0d19879a6560dcde44 (patch) | |
| tree | 0a112bc096e6ea9be74f2274005aed0606e38f8a /hints | |
| parent | 2c8ca683ba2cfa11ba67ed8364aabd92180ec161 (diff) | |
| download | perl-2709980d5a193ce6f3a16f0d19879a6560dcde44.tar.gz | |
avoid calling memset with a negative count
Poorly written perl code that allows an attacker to specify the count to
perl's 'x' string repeat operator can already cause a memory exhaustion
denial-of-service attack. A flaw in versions of perl before 5.15.5 can
escalate that into a heap buffer overrun; coupled with versions of glibc
before 2.16, it possibly allows the execution of arbitrary code.
The flaw addressed to this commit has been assigned identifier
CVE-2012-5195.
Diffstat (limited to 'hints')
0 files changed, 0 insertions, 0 deletions