CVE-2018-6913 — perl - security update

Description

Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count.

How to fix CVE-2018-6913

To remediate CVE-2018-6913, upgrade the affected package to a fixed version below.

Alpine/perl—upgrade to 5.26.2-r0 or later
Debian/perl—upgrade to 5.26.1-6 or later
—upgrade to 5.14.2-21+deb7u6 or later
—upgrade to 5.20.2-3+deb8u10 or later

Is CVE-2018-6913 being exploited?

Low — EPSS is 3.9%, meaning exploitation activity has not been observed at scale.

Affected packages (4)

from 0, < 5.26.2-r0
from 0, < 5.26.1-6
from 0, < 5.14.2-21+deb7u6
from 0, < 5.20.2-3+deb8u10

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (2)

ADVISORYsecurity.alpinelinux.org/vuln/CVE-2018-6913
ADVISORYsecurity-tracker.debian.org/tracker/CVE-2018-6913