CVE-2017-12883
CriticalSummary
A buffer overflow vulnerability was discovered in Perl before versions 5.24.3-RC1 and 5.26.1-RC1 in the S_grok_bslash_N function in regcomp.c. This allows a remote attacker to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\N{U+...}' escape.
Risk Assessment
The risk includes potential leakage of confidential data from process memory or disruption of application operation, which may lead to security breaches and system availability issues.
Recommendation
Immediately update Perl to version 5.24.3-RC1, 5.26.1-RC1, or later. If updating is not possible, restrict processing of untrusted regular expressions.
Original NVD description (English source)
Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\N{U+...}' escape.