Описание
Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | needs-triage | |
| esm-infra-legacy/trusty | released | 5.18.2-2ubuntu1.7+esm8 |
| esm-infra-legacy/xenial | released | 5.22.1-9ubuntu0.9+esm3 |
| esm-infra/bionic | released | 5.26.1-6ubuntu0.7+esm3 |
| esm-infra/focal | released | 5.30.0-9ubuntu0.5+esm3 |
| jammy | released | 5.34.0-3ubuntu1.8 |
| noble | released | 5.38.2-3.2ubuntu0.4 |
| resolute | released | 5.40.1-7ubuntu0.3 |
| upstream | released | 5.43.11 |
Показывать по
EPSS
9.8 Critical
CVSS3
Связанные уязвимости
Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.
Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.
Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record
Storable versions before 3.41 for Perl have a signed integer overflow ...
Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.
EPSS
9.8 Critical
CVSS3