CVE-2016-1238

Perl may allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

A vulnerability in Perl 5.30.0 through 5.38.0 allows a heap buffer overflow when compiling a crafted regular expression. An attacker can exploit this to cause a controlled buffer overflow.

A heap buffer overflow vulnerability was discovered in Perl. Affected versions include release branches 5.34, 5.36, 5.38, and 5.40, as well as development versions from 5.33.1 through 5.41.10. When non-ASCII bytes are present in the left-hand side of the `tr` operator, `S_do_trans_invmap` can overflow the buffer.

In Perl versions up to 5.43.9, when compiling an alternation of more than 65535 fixed string branches into a trie in Perl_study_chunk, a 16-bit field storing the delta between the first branch and the shared tail overflows. This truncates the trie's match decision table without warning or error, causing false positive and false negative regular expression matches.

Perl versions up to 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. The bug in Perl_study_chunk leads to an undersized buffer allocation and subsequent out-of-bounds write.

The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. This can lead to missed matches or matching on the wrong branch.

A vulnerability in Perl's regular expression engine (up to version 5.45.1) causes out-of-bounds reads and writes during pattern matching. The issue stems from an integer overflow in the superlinear cache counter, leading to undersized allocation and subsequent out-of-bounds access.

In Perl up to version 5.43.10, an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack. A large repeat count wraps the total negative, bypassing length checks and allowing reading past the buffer.

Perl 5.004_04 and earlier follows symbolic links when running with the -e option, allowing local users to overwrite arbitrary files via a symlink attack on the /tmp/perl-eaXXXXX file.