CVE-2011-0761

2011-05-1300:00:00

ubuntu.com

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.021 Low

EPSS

Percentile

89.0%

JSON

Perl 5.10.x allows context-dependent attackers to cause a denial of service
(NULL pointer dereference and application crash) by leveraging an ability
to inject arguments into a (1) getpeername, (2) readdir, (3) closedir, (4)
getsockname, (5) rewinddir, (6) tell, or (7) telldir function call.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=628817>

Notes

Author	Note
sbeattie	toucan systems advisory has PoC
seth-arnold	ignoring this CVE: flaw requires extremely poorly written software to exploit the problem (allow input to modify the number of arguments to fundamental functions), crashes do not appear to be under argument control. Upstream Perl team does not consider it a security-relevant problem and thus have not prepared any patches.