Buffer overflow in Nwclark Storable
CVE-2017-20230
Storable versions before 3.05 for Perl has a stack overflow. The retrieve_hook function stored the length of the class name into a signed integer but in read operations treated the length as unsigned. This allowed an attacker to craft dat…
Vulnerability class: Buffer Overflow
EPSS: 0.000 (11.3th percentile) — read the EPSS interpretation.
Affected products
- Nwclark Storable — versions 0
Weakness classification (CWE)
References
- github.com/Perl/perl5/issues/15831 (issue-tracking)
- github.com/Perl/perl5/commit/a258c17c6937f79529c8319a829310e09cdbd216.patch (patch)
- metacpan.org/release/RURBAN/Storable-3.05/changes (release-notes)
- www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242533.html (mailing-list)
- www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242703.html (mailing-list)