CVE-2018-6798
UnknownEPSS 4.00%
Last modified
CVE-2018-6798 is a vulnerability of currently unknown severity. An issue was discovered in Perl 5.22 through 5.26. Matching a crafted locale dependent regular expression can cause a heap-based buffer over-read and potentially information disclosure.. EPSS estimates a 4.00% chance of exploitation in the next 30 days.
Description
An issue was discovered in Perl 5.22 through 5.26. Matching a crafted locale dependent regular expression can cause a heap-based buffer over-read and potentially information disclosure.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Debian | Debian Linux | 7.0 |
| Debian | Debian Linux | 8.0 |
| Debian | Debian Linux | 9.0 |
| Perl | Perl | >= 5.22, <= 5.26 |
| Canonical | Ubuntu Linux | 14.04 |
| Canonical | Ubuntu Linux | 16.04 |
| Canonical | Ubuntu Linux | 17.10 |
| Redhat | Enterprise Linux Server | 6.0 |
| Redhat | Enterprise Linux Server | 7.0 |
| Redhat | Enterprise Linux Server | 7.3 |
| Redhat | Enterprise Linux Server | 7.4 |
| Redhat | Enterprise Linux Server | 7.5 |
| Redhat | Enterprise Linux Workstation | 6.0 |
| Redhat | Enterprise Linux Workstation | 7.0 |
References
- http://www.securitytracker.com/id/1040681Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:1192Third Party Advisory
- https://rt.perl.org/Public/Bug/Display.html?id=132063Vendor Advisory
- https://usn.ubuntu.com/3625-1/Third Party Advisory
- https://www.debian.org/security/2018/dsa-4172Third Party Advisory
- http://www.securitytracker.com/id/1040681Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:1192Third Party Advisory
- https://rt.perl.org/Public/Bug/Display.html?id=132063Vendor Advisory
- https://usn.ubuntu.com/3625-1/Third Party Advisory
- https://www.debian.org/security/2018/dsa-4172Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-6798?
An issue was discovered in Perl 5.22 through 5.26. Matching a crafted locale dependent regular expression can cause a heap-based buffer over-read and potentially information disclosure.
How severe is CVE-2018-6798?
Severity scoring for CVE-2018-6798 is pending analysis. The EPSS model estimates a 4.00% probability of exploitation in the next 30 days.
How do I fix CVE-2018-6798?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-6791An issue was discovered in soliduiserver/deviceserviceaction…
- CVE-2018-6792Multiple SQL injection vulnerabilities in Saifor CVMS HUB 1.…
- CVE-2018-6794Suricata before 4.0.4 is prone to an HTTP detection bypass v…
- CVE-2018-6795PHP Scripts Mall Naukri Clone Script 3.0.3 has Stored XSS vi…
- CVE-2018-6796PHP Scripts Mall Multilanguage Real Estate MLM Script 3.0 ha…
- CVE-2018-6797An issue was discovered in Perl 5.18 through 5.26. A crafted…
- CVE-2018-6799The AcquireCacheNexus function in magick/pixel_cache.c in Gr…
- CVE-2018-6806Marked 2 through 2.5.11 allows remote attackers to read arbi…6.5
- CVE-2018-6808NetScaler ADC 10.5, 11.0, 11.1, and 12.0, and NetScaler Gate…
- CVE-2018-6809NetScaler ADC 10.5, 11.0, 11.1, and 12.0, and NetScaler Gate…
- CVE-2018-6810Directory traversal vulnerability in NetScaler ADC 10.5, 11.…
- CVE-2018-6811Multiple cross-site scripting (XSS) vulnerabilities in Citri…
Are you affected by CVE-2018-6798?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST
