Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Ubuntu:Pro:14.04:LTS perl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.2-2ubuntu1.7+esm8"}]}]

Ubuntu:Pro:16.04:LTS perl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.1-9ubuntu0.9+esm3"}]}]

Ubuntu:Pro:18.04:LTS perl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-6ubuntu0.7+esm3"}]}]

Ubuntu:Pro:20.04:LTS perl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.30.0-9ubuntu0.5+esm3"}]}]

Ubuntu:22.04:LTS perl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.34.0-3ubuntu1.8"}]}]

Ubuntu:24.04:LTS perl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.38.2-3.2ubuntu0.4"}]}]

Ubuntu:26.04:LTS perl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.40.1-7ubuntu0.3"}]}]

参照URL

advisory ubuntu.com
advisory ubuntu.com
advisory ubuntu.com
report ubuntu.com
report cve.org
report lists.security.metacpan.org