CVE-2024-56406
Last modified
CVE-2024-56406 is a high-severity vulnerability rated 8.4/10 on the CVSS scale. A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`. $ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;' Segmentation fault (core dumped) It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.. EPSS estimates a 0.47% chance of exploitation in the next 30 days.
Description
A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`. $ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;' Segmentation fault (core dumped) It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Perl | Perl | >= 5.33.1, < 5.38.4 |
| Perl | Perl | >= 5.39.0, < 5.40.2 |
| Perl | Perl | >= 5.41.0, <= 5.41.10 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-56406?
How severe is CVE-2024-56406?
How do I fix CVE-2024-56406?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-56377A stored cross-site scripting (XSS) vulnerability in survey …5.4
- CVE-2024-56378libpoppler.so in Poppler through 24.12.0 has an out-of-bound…4.3
- CVE-2024-5638The Formula theme for WordPress is vulnerable to Reflected C…6.1
- CVE-2024-5639The User Profile Picture plugin for WordPress is vulnerable …4.3
- CVE-2024-5640The Prime Slider – Addons For Elementor (Revolution of a sli…5.4
- CVE-2024-56404In One Identity Identity Manager 9.x before 9.3, an insecure…9.9
- CVE-2024-56408PhpSpreadsheet is a PHP library for reading and writing spre…5.4
- CVE-2024-56409PhpSpreadsheet is a PHP library for reading and writing spre…5.4
- CVE-2024-5641The One Click Order Re-Order plugin for WordPress is vulnera…5.4
- CVE-2024-56410PhpSpreadsheet is a PHP library for reading and writing spre…5.4
- CVE-2024-56411PhpSpreadsheet is a PHP library for reading and writing spre…5.4
- CVE-2024-56412PhpSpreadsheet is a PHP library for reading and writing spre…5.4
Are you affected by CVE-2024-56406?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST