Most recent entries from all

ALSA-2025:7500 — Important: perl security update

Affected: AlmaLinux:10: perl, AlmaLinux:10: perl-Attribute-Handlers, AlmaLinux:10: perl-AutoLoader, AlmaLinux:10: perl-AutoSplit, AlmaLinux:10: perl-B, AlmaLinux:10: perl-Benchmark, AlmaLinux:10: perl-Class-Struct, AlmaLinux:10: perl-Config-Extensions, AlmaLinux:10: perl-DBM_Filter, AlmaLinux:10: perl-Devel-Peek and 90 more

Perl is a high-level programming language that is commonly used for system administration utilities and web programming.

Security Fix(es):

* perl: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a heap buffer overflow when transliterating non-ASCII bytes (CVE-2024-56406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-04857

BELL-CVE-2024-56406

Affected: Alpaquita:23: perl, Alpaquita:stream: perl, BellSoft Hardened Containers:23: perl, BellSoft Hardened Containers:stream: perl

certfr-2025-avi-0524 — De multiples vulnérabilités ont été découvertes dans VMware Tanzu. Elles permettent à un attaquant de provoquer un prob…

certfr-2025-avi-0524

EUVD-2026-255221

fkie_cve-2024-56406

A heap buffer overflow vulnerability was discovered in Perl.

Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10.

When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`.

$ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;' Segmentation fault (core dumped)

It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.

GHSA-p6jf-pv8c-623c

A heap buffer overflow vulnerability was discovered in Perl.

When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`.

$ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;' Segmentation fault (core dumped)

It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.

msrc_CVE-2024-56406 — Perl is vulnerable to a heap buffer overflow when transliterating non-ASCII bytes

msrc_CVE-2024-56406

NCSC-2026-0027 — Kwetsbaarheden verholpen in Oracle Fusion Middleware

NCSC-2026-0027

OESA-2025-1470 — perl security update

Affected: openEuler:24.03-LTS: perl

Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects. Security Fix(es):

A heap buffer overflow vulnerability was discovered in Perl.

Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10.

When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`.

$ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;' Segmentation fault (core dumped)

It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.(CVE-2024-56406)

openSUSE-SU-2025:15003-1 — perl-32bit-5.40.2-1.1 on GA media

perl-32bit-5.40.2-1.1 on GA media

RHSA-2025:7500 — Red Hat Security Advisory: perl security update

perl: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a heap buffer overflow when transliterating non-ASCII bytes

SUSE-SU-2025:20334-1 — Security update for perl

Security update for perl

UBUNTU-CVE-2024-56406

Affected: Ubuntu:22.04:LTS: perl, Ubuntu:24.04:LTS: perl

A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`. $ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;' Segmentation fault (core dumped) It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.

WID-SEC-W-2025-0791 — Perl: Schwachstelle ermöglicht Denial of Service und potentiell Codeausführung

Ein Angreifer kann eine Schwachstelle in Perl ausnutzen, um einen Denial of Service zu verursachen und potentiell beliebigen Programmcode auszuführen.