Vulnerabilities > CVE-2018-18311 - Integer Overflow or Wraparound vulnerability in multiple products

Part	Description	Count
Application	Perl Perl Perl - Perl Perl 0.1 Perl Perl 0.2 Perl Perl 0.3 Perl Perl 0.4 Perl Perl 0.5 Perl Perl 0.52 Perl Perl 0.61 Perl Perl 0.62 Perl Perl 0.63 Perl Perl 0.64 Perl Perl 0.65 Perl Perl 0.66 Perl Perl 0.67 Perl Perl 0.68 Perl Perl 0.69 Perl Perl 0.70 Perl Perl 0.71 Perl Perl 0.72 Perl Perl 0.73 Perl Perl 0.80 Perl Perl 0.81 Perl Perl 0.82 Perl Perl 0.83 Perl Perl 0.84 Perl Perl 0.85 Perl Perl 0.86 Perl Perl 0.87 Perl Perl 0.88 Perl Perl 0.89 Perl Perl 0.90 Perl Perl 0.91 Perl Perl 0.92 Perl Perl 0.93 Perl Perl 0.94 Perl Perl 0.95 Perl Perl 0.96 Perl Perl 0.97 Perl Perl 0.98 Perl Perl 0.99 Perl Perl 1.00 Perl Perl 1.0.15 Perl Perl 1.0.16 Perl Perl 1.01 Perl Perl 1.20 Perl Perl 1.21 Perl Perl 1.22 Perl Perl 1.31 Perl Perl 1.32 Perl Perl 1.40 Perl Perl 1.41 Perl Perl 1.42 Perl Perl 1.43 Perl Perl 1.44 Perl Perl 1.45 Perl Perl 1.46 Perl Perl 1.47 Perl Perl 1.48 Perl Perl 1.49 Perl Perl 2.0.0 Perl Perl 2.1.0 Perl Perl 2.1.1 Perl Perl 2.1.2 Perl Perl 2.1.3 Perl Perl 2.2.0 Perl Perl 2.2.1 Perl Perl 2.2.2 Perl Perl 2.3.0 Perl Perl 2.4.0 Perl Perl 2.5.0 Perl Perl 2.5.1 Perl Perl 2.6.0 Perl Perl 2.6.1 Perl Perl 2.6.2 Perl Perl 2.6.3 Perl Perl 2.6.4 Perl Perl 2.6.5 Perl Perl 2.6.6 Perl Perl 2.7.0 Perl Perl 2.7.1 Perl Perl 2.7.2 Perl Perl 2.8.0 Perl Perl 2.8.1 Perl Perl 2.8.2 Perl Perl 2.8.3 Perl Perl 2.8.4 Perl Perl 2.8.5 Perl Perl 2.8.6 Perl Perl 2.8.7 Perl Perl 2.8.8 Perl Perl 2.9.0 Perl Perl 2.9.1 Perl Perl 2.9.2 Perl Perl 2.10.0 Perl Perl 2.10.1 Perl Perl 2.10.2 Perl Perl 2.10.3 Perl Perl 2.10.4 Perl Perl 2.10.5 Perl Perl 2.10.6 Perl Perl 2.10.7 Perl Perl 2.11.0 Perl Perl 2.11.1 Perl Perl 2.11.2 Perl Perl 2.11.3 Perl Perl 2.11.4 Perl Perl 2.11.5 Perl Perl 2.11.6 Perl Perl 2.11.7 Perl Perl 2.11.8 Perl Perl 2.12.0 Perl Perl 2.13.0 Perl Perl 2.14.0 Perl Perl 2.14.1 Perl Perl 2.15.0 Perl Perl 2.15.1 Perl Perl 2.16.0 Perl Perl 2.16.1 Perl Perl 2.17.0 Perl Perl 2.17.1 Perl Perl 2.17.2 Perl Perl 2.18.0 Perl Perl 2.18.1 Perl Perl 5.000 Perl Perl 5.000O Perl Perl 5.001 Perl Perl 5.001N Perl Perl 5.002 Perl Perl 5.002_01 Perl Perl 5.003 Perl Perl 5.003_01 Perl Perl 5.003_02 Perl Perl 5.003_03 Perl Perl 5.003_04 Perl Perl 5.003_05 Perl Perl 5.003_07 Perl Perl 5.003_08 Perl Perl 5.003_09 Perl Perl 5.003_10 Perl Perl 5.003_11 Perl Perl 5.003_12 Perl Perl 5.003_13 Perl Perl 5.003_14 Perl Perl 5.003_15 Perl Perl 5.003_16 Perl Perl 5.003_17 Perl Perl 5.003_18 Perl Perl 5.003_19 Perl Perl 5.003_20 Perl Perl 5.003_21 Perl Perl 5.003_22 Perl Perl 5.003_23 Perl Perl 5.003_24 Perl Perl 5.003_25 Perl Perl 5.003_26 Perl Perl 5.003_27 Perl Perl 5.003_28 Perl Perl 5.003_90 Perl Perl 5.003_91 Perl Perl 5.003_92 Perl Perl 5.003_93 Perl Perl 5.003_94 Perl Perl 5.003_95 Perl Perl 5.003_96 Perl Perl 5.003_97 Perl Perl 5.003_97A Perl Perl 5.003_97B Perl Perl 5.003_97C Perl Perl 5.003_97D Perl Perl 5.003_97E Perl Perl 5.003_97F Perl Perl 5.003_97G Perl Perl 5.003_97H Perl Perl 5.003_97I Perl Perl 5.003_97J Perl Perl 5.003_98 Perl Perl 5.003_99 Perl Perl 5.003_99A Perl Perl 5.004 Perl Perl 5.004_01 Perl Perl 5.004_02 Perl Perl 5.004_03 Perl Perl 5.004_04 Perl Perl 5.004_05 Perl Perl 5.005 Perl Perl 5.005_01 Perl Perl 5.005_02 Perl Perl 5.005_03 Perl Perl 5.005_04 Perl Perl 5.6 Perl Perl 5.6.0 Perl Perl 5.6.1 Perl Perl 5.6.2 Perl Perl 5.7.3 Perl Perl 5.8 Perl Perl 5.8.0 Perl Perl 5.8.1 Perl Perl 5.8.2 Perl Perl 5.8.3 Perl Perl 5.8.4 Perl Perl 5.8.5 Perl Perl 5.8.6 Perl Perl 5.8.7 Perl Perl 5.8.8 Perl Perl 5.8.9 Perl Perl 5.8.10 Perl Perl 5.9.0 Perl Perl 5.9.1 Perl Perl 5.9.2 Perl Perl 5.9.3 Perl Perl 5.9.4 Perl Perl 5.9.5 Perl Perl 5.10 Perl Perl 5.10.0 Perl Perl 5.10.1 Perl Perl 5.11.0 Perl Perl 5.11.1 Perl Perl 5.11.2 Perl Perl 5.11.3 Perl Perl 5.11.4 Perl Perl 5.11.5 Perl Perl 5.12.0 Perl Perl 5.12.1 Perl Perl 5.12.2 Perl Perl 5.12.3 Perl Perl 5.12.4 Perl Perl 5.12.5 Perl Perl 5.13.0 Perl Perl 5.13.1 Perl Perl 5.13.2 Perl Perl 5.13.3 Perl Perl 5.13.4 Perl Perl 5.13.5 Perl Perl 5.13.6 Perl Perl 5.13.7 Perl Perl 5.13.8 Perl Perl 5.13.9 Perl Perl 5.13.10 Perl Perl 5.13.11 Perl Perl 5.14.0 Perl Perl 5.14.1 Perl Perl 5.14.2 Perl Perl 5.14.3 Perl Perl 5.14.4 Perl Perl 5.15.0 Perl Perl 5.15.1 Perl Perl 5.15.2 Perl Perl 5.15.3 Perl Perl 5.15.4 Perl Perl 5.15.5 Perl Perl 5.15.6 Perl Perl 5.15.7 Perl Perl 5.15.8 Perl Perl 5.15.9 Perl Perl 5.16.0 Perl Perl 5.16.1 Perl Perl 5.16.2 Perl Perl 5.16.3 Perl Perl 5.17.0 Perl Perl 5.17.1 Perl Perl 5.17.2 Perl Perl 5.17.3 Perl Perl 5.17.4 Perl Perl 5.17.5 Perl Perl 5.17.6 Perl Perl 5.17.7 Perl Perl 5.17.7.0 Perl Perl 5.17.8 Perl Perl 5.17.9 Perl Perl 5.17.10 Perl Perl 5.17.11 Perl Perl 5.18.0 Perl Perl 5.18.1 Perl Perl 5.18.2 Perl Perl 5.18.3 Perl Perl 5.18.4 Perl Perl 5.19.0 Perl Perl 5.19.1 Perl Perl 5.19.2 Perl Perl 5.19.3 Perl Perl 5.19.4 Perl Perl 5.19.5 Perl Perl 5.19.6 Perl Perl 5.19.7 Perl Perl 5.19.8 Perl Perl 5.19.9 Perl Perl 5.19.10 Perl Perl 5.19.11 Perl Perl 5.20.0 Perl Perl 5.20.1 Perl Perl 5.20.2 Perl Perl 5.20.3 Perl Perl 5.21.0 Perl Perl 5.21.1 Perl Perl 5.21.2 Perl Perl 5.21.3 Perl Perl 5.21.4 Perl Perl 5.21.5 Perl Perl 5.21.6 Perl Perl 5.21.7 Perl Perl 5.21.8 Perl Perl 5.21.9 Perl Perl 5.21.10 Perl Perl 5.21.11 Perl Perl 5.22 Perl Perl 5.22.0 Perl Perl 5.22.1 Perl Perl 5.22.2 Perl Perl 5.22.3 Perl Perl 5.22.4 Perl Perl 5.23.0 Perl Perl 5.23.1 Perl Perl 5.23.2 Perl Perl 5.23.3 Perl Perl 5.23.4 Perl Perl 5.23.5 Perl Perl 5.23.6 Perl Perl 5.23.7 Perl Perl 5.23.8 Perl Perl 5.23.9 Perl Perl 5.24.0 Perl Perl 5.24.1 Perl Perl 5.24.2 Perl Perl 5.24.3 Perl Perl 5.24.4 Perl Perl 5.25.0 Perl Perl 5.25.1 Perl Perl 5.25.2 Perl Perl 5.25.3 Perl Perl 5.25.4 Perl Perl 5.25.5 Perl Perl 5.25.6 Perl Perl 5.25.7 Perl Perl 5.25.8 Perl Perl 5.25.9 Perl Perl 5.25.10 Perl Perl 5.25.11 Perl Perl 5.25.12 Perl Perl 5.26.0 Perl Perl 5.26.1 Perl Perl 5.26.2 Perl Perl 5.28.0	426
Application	Netapp Netapp Snap Creator Framework - Netapp Snapcenter - Netapp E Series Santricity OS Controller - Netapp Snapdriver -	4
Application	Redhat Redhat Openshift Container Platform 3.11	1
Application	Mcafee Mcafee WEB Gateway 8.0.0 Mcafee WEB Gateway 8.0.1 Mcafee WEB Gateway 8.0.2 Mcafee WEB Gateway 8.0.3 Mcafee WEB Gateway 8.1 Mcafee WEB Gateway 8.1.0 Mcafee WEB Gateway 7.8.2 Mcafee WEB Gateway 7.8.2.0 Mcafee WEB Gateway 7.8.2.1 Mcafee WEB Gateway 7.8.2.2 Mcafee WEB Gateway 7.8.2.3 Mcafee WEB Gateway 7.8.2.4 Mcafee WEB Gateway 7.8.2.5 Mcafee WEB Gateway 7.8.2.6 Mcafee WEB Gateway 7.8.2.7 Mcafee WEB Gateway 7.7.2 Mcafee WEB Gateway 7.7.2.0 Mcafee WEB Gateway 7.7.2.1 Mcafee WEB Gateway 7.7.2.2 Mcafee WEB Gateway 7.7.2.3 Mcafee WEB Gateway 7.7.2.4 Mcafee WEB Gateway 7.7.2.5 Mcafee WEB Gateway 7.7.2.6 Mcafee WEB Gateway 7.7.2.7 Mcafee WEB Gateway 7.7.2.8 Mcafee WEB Gateway 7.7.2.9 Mcafee WEB Gateway 7.7.2.10 Mcafee WEB Gateway 7.7.2.11 Mcafee WEB Gateway 7.7.2.12 Mcafee WEB Gateway 7.7.2.13 Mcafee WEB Gateway 7.7.2.14 Mcafee WEB Gateway 7.7.2.15 Mcafee WEB Gateway 7.7.2.16 Mcafee WEB Gateway 7.7.2.17 Mcafee WEB Gateway 7.7.2.18 Mcafee WEB Gateway 7.7.2.19 Mcafee WEB Gateway 7.7.2.20	37
OS	Canonical Canonical Ubuntu Linux 16.04 Canonical Ubuntu Linux 14.04 Canonical Ubuntu Linux 12.04 Canonical Ubuntu Linux 18.04 Canonical Ubuntu Linux 18.10	5
OS	Debian Debian Debian Linux 8.0 Debian Debian Linux 9.0	2
OS	Redhat Redhat Enterprise Linux Desktop 7.0 Redhat Enterprise Linux 7.4 Redhat Enterprise Linux 7.0 Redhat Enterprise Linux 6.0 Redhat Enterprise Linux 7.5 Redhat Enterprise Linux 7.6 Redhat Enterprise Linux Workstation 7.0 Redhat Enterprise Linux Server 7.0 Redhat Enterprise Linux Server TUS 7.6 Redhat Enterprise Linux Server AUS 7.6 Redhat Enterprise Linux EUS 7.6	11
OS	Apple Apple MAC OS X - Apple MAC OS X 10.0 Apple MAC OS X 10.0.0 Apple MAC OS X 10.0.1 Apple MAC OS X 10.0.2 Apple MAC OS X 10.0.3 Apple MAC OS X 10.0.4 Apple MAC OS X 10.1 Apple MAC OS X 10.1.0 Apple MAC OS X 10.1.1 Apple MAC OS X 10.1.2 Apple MAC OS X 10.1.3 Apple MAC OS X 10.1.4 Apple MAC OS X 10.1.5 Apple MAC OS X 10.2 Apple MAC OS X 10.2.0 Apple MAC OS X 10.2.1 Apple MAC OS X 10.2.2 Apple MAC OS X 10.2.3 Apple MAC OS X 10.2.4 Apple MAC OS X 10.2.5 Apple MAC OS X 10.2.6 Apple MAC OS X 10.2.7 Apple MAC OS X 10.2.8 Apple MAC OS X 10.3 Apple MAC OS X 10.3.0 Apple MAC OS X 10.3.1 Apple MAC OS X 10.3.2 Apple MAC OS X 10.3.3 Apple MAC OS X 10.3.4 Apple MAC OS X 10.3.5 Apple MAC OS X 10.3.6 Apple MAC OS X 10.3.7 Apple MAC OS X 10.3.8 Apple MAC OS X 10.3.9 Apple MAC OS X 10.4 Apple MAC OS X 10.4.0 Apple MAC OS X 10.4.1 Apple MAC OS X 10.4.2 Apple MAC OS X 10.4.3 Apple MAC OS X 10.4.4 Apple MAC OS X 10.4.5 Apple MAC OS X 10.4.6 Apple MAC OS X 10.4.7 Apple MAC OS X 10.4.8 Apple MAC OS X 10.4.9 Apple MAC OS X 10.4.10 Apple MAC OS X 10.4.11 Apple MAC OS X 10.5 Apple MAC OS X 10.5.0 Apple MAC OS X 10.5.1 Apple MAC OS X 10.5.2 Apple MAC OS X 10.5.3 Apple MAC OS X 10.5.4 Apple MAC OS X 10.5.5 Apple MAC OS X 10.5.6 Apple MAC OS X 10.5.7 Apple MAC OS X 10.5.8 Apple MAC OS X 10.6.0 Apple MAC OS X 10.6.1 Apple MAC OS X 10.6.2 Apple MAC OS X 10.6.3 Apple MAC OS X 10.6.4 Apple MAC OS X 10.6.5 Apple MAC OS X 10.6.6 Apple MAC OS X 10.6.7 Apple MAC OS X 10.6.8 Apple MAC OS X 10.7.0 Apple MAC OS X 10.7.1 Apple MAC OS X 10.7.2 Apple MAC OS X 10.7.3 Apple MAC OS X 10.7.4 Apple MAC OS X 10.7.5 Apple MAC OS X 10.8.0 Apple MAC OS X 10.8.1 Apple MAC OS X 10.8.2 Apple MAC OS X 10.8.3 Apple MAC OS X 10.8.4 Apple MAC OS X 10.8.5 Apple MAC OS X 10.9 Apple MAC OS X 10.9.1 Apple MAC OS X 10.9.2 Apple MAC OS X 10.9.3 Apple MAC OS X 10.9.4 Apple MAC OS X 10.9.5 Apple MAC OS X 10.10.0 Apple MAC OS X 10.10.1 Apple MAC OS X 10.10.2 Apple MAC OS X 10.10.3 Apple MAC OS X 10.10.4 Apple MAC OS X 10.10.5 Apple MAC OS X 10.11.0 Apple MAC OS X 10.11.1 Apple MAC OS X 10.11.2 Apple MAC OS X 10.11.3 Apple MAC OS X 10.11.4 Apple MAC OS X 10.11.5 Apple MAC OS X 10.11.6 Apple MAC OS X 10.12 Apple MAC OS X 10.12.0 Apple MAC OS X 10.12.1 Apple MAC OS X 10.12.2 Apple MAC OS X 10.12.3 Apple MAC OS X 10.12.4 Apple MAC OS X 10.12.5 Apple MAC OS X 10.12.6 Apple MAC OS X 10.13 Apple MAC OS X 10.13.0 Apple MAC OS X 10.13.1 Apple MAC OS X 10.13.2 Apple MAC OS X 10.13.3 Apple MAC OS X 10.13.4 Apple MAC OS X 10.13.5 Apple MAC OS X 10.13.6 Apple MAC OS X 10.14 Apple MAC OS X 10.14.0 Apple MAC OS X 10.14.1 Apple MAC OS X 10.14.2 Apple MAC OS X 10.14.3	158
OS	Fedoraproject Fedoraproject Fedora 29	1

Common Weakness Enumeration (CWE)

CWE-190 - Integer Overflow or Wraparound

Common Attack Pattern Enumeration and Classification (CAPEC)

Forced Integer Overflow
This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.

Nessus

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2018-CA03363D57.NASL
description	Security fix for CVE-2018-18311, CVE-2018-18312, CVE-2018-18313 and CVE-2018-18314 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-05
modified	2019-01-03
plugin id	120786
published	2019-01-03
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/120786
title	Fedora 28 : 4:perl (2018-ca03363d57)
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Fedora Security Advisory FEDORA-2018-ca03363d57. # include("compat.inc"); if (description) { script_id(120786); script_version("1.4"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04"); script_cve_id("CVE-2018-18311", "CVE-2018-18312", "CVE-2018-18313", "CVE-2018-18314"); script_xref(name:"FEDORA", value:"2018-ca03363d57"); script_name(english:"Fedora 28 : 4:perl (2018-ca03363d57)"); script_summary(english:"Checks rpm output for the updated package."); script_set_attribute( attribute:"synopsis", value:"The remote Fedora host is missing a security update." ); script_set_attribute( attribute:"description", value: "Security fix for CVE-2018-18311, CVE-2018-18312, CVE-2018-18313 and CVE-2018-18314 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://bodhi.fedoraproject.org/updates/FEDORA-2018-ca03363d57" ); script_set_attribute( attribute:"solution", value:"Update the affected 4:perl package." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:4:perl"); script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:28"); script_set_attribute(attribute:"vuln_publication_date", value:"2018/12/05"); script_set_attribute(attribute:"patch_publication_date", value:"2018/12/12"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/01/03"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Fedora Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) \|\| "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora"); os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora"); os_ver = os_ver[1]; if (! preg(pattern:"^28([^0-9]\|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 28", "Fedora " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu); flag = 0; if (rpm_check(release:"FC28", reference:"perl-5.26.3-415.fc28", epoch:"4")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "4:perl"); }

NASL family	PhotonOS Local Security Checks
NASL id	PHOTONOS_PHSA-2019-1_0-0212_MYSQL.NASL
description	An update of the mysql package has been released.
last seen	2020-06-01
modified	2020-06-02
plugin id	122922
published	2019-03-18
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/122922
title	Photon OS 1.0: Mysql PHSA-2019-1.0-0212
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from VMware Security Advisory PHSA-2019-1.0-0212. The text # itself is copyright (C) VMware, Inc. include("compat.inc"); if (description) { script_id(122922); script_version("1.2"); script_cvs_date("Date: 2020/02/04"); script_cve_id("CVE-2018-3155", "CVE-2019-2534"); script_name(english:"Photon OS 1.0: Mysql PHSA-2019-1.0-0212"); script_summary(english:"Checks the rpm output for the updated packages."); script_set_attribute(attribute:"synopsis", value: "The remote PhotonOS host is missing multiple security updates."); script_set_attribute(attribute:"description", value: "An update of the mysql package has been released."); script_set_attribute(attribute:"see_also", value:"https://github.com/vmware/photon/wiki/Security-Updates-1.0-212.md"); script_set_attribute(attribute:"solution", value: "Update the affected Linux packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-18311"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"vuln_publication_date", value:"2018/07/27"); script_set_attribute(attribute:"patch_publication_date", value:"2019/03/05"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/03/18"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:vmware:photonos:mysql"); script_set_attribute(attribute:"cpe", value:"cpe:/o:vmware:photonos:1.0"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"PhotonOS Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/PhotonOS/release", "Host/PhotonOS/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/PhotonOS/release"); if (isnull(release) \|\| release !~ "^VMware Photon") audit(AUDIT_OS_NOT, "PhotonOS"); if (release !~ "^VMware Photon (?:Linux\|OS) 1\.0(\D\|$)") audit(AUDIT_OS_NOT, "PhotonOS 1.0"); if (!get_kb_item("Host/PhotonOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "PhotonOS", cpu); flag = 0; if (rpm_check(release:"PhotonOS-1.0", reference:"mysql-5.7.25-1.ph1")) flag++; if (rpm_check(release:"PhotonOS-1.0", reference:"mysql-debuginfo-5.7.25-1.ph1")) flag++; if (rpm_check(release:"PhotonOS-1.0", reference:"mysql-devel-5.7.25-1.ph1")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "mysql"); }

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-1717.NASL
description	According to the version of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.(CVE-2018-18311) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-05-06
modified	2019-07-22
plugin id	126845
published	2019-07-22
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/126845
title	EulerOS 2.0 SP2 : perl (EulerOS-SA-2019-1717)
code	# # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(126845); script_version("1.3"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/04"); script_cve_id( "CVE-2018-18311" ); script_name(english:"EulerOS 2.0 SP2 : perl (EulerOS-SA-2019-1717)"); script_summary(english:"Checks the rpm output for the updated package."); script_set_attribute(attribute:"synopsis", value: "The remote EulerOS host is missing a security update."); script_set_attribute(attribute:"description", value: "According to the version of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.(CVE-2018-18311) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues."); # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1717 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2228669f"); script_set_attribute(attribute:"solution", value: "Update the affected perl package."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"patch_publication_date", value:"2019/07/23"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/07/22"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:perl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:perl-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:perl-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:perl-libs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:perl-macros"); script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Huawei Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp"); script_exclude_keys("Host/EulerOS/uvp_version"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/EulerOS/release"); if (isnull(release) \|\| release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS"); if (release !~ "^EulerOS release 2\.0(\D\|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0"); sp = get_kb_item("Host/EulerOS/sp"); if (isnull(sp) \|\| sp !~ "^(2)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP2"); uvp = get_kb_item("Host/EulerOS/uvp_version"); if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP2", "EulerOS UVP " + uvp); if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu); flag = 0; pkgs = ["perl-5.16.3-285.h3", "perl-core-5.16.3-285.h3", "perl-devel-5.16.3-285.h3", "perl-libs-5.16.3-285.h3", "perl-macros-5.16.3-285.h3"]; foreach (pkg in pkgs) if (rpm_check(release:"EulerOS-2.0", sp:"2", reference:pkg)) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "perl"); }

NASL family	Amazon Linux Local Security Checks
NASL id	ALA_ALAS-2019-1180.NASL
description	Perl has a buffer overflow via a crafted regular expression that triggers invalid write operations. (CVE-2018-18311)
last seen	2020-06-01
modified	2020-06-02
plugin id	123088
published	2019-03-26
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/123088
title	Amazon Linux AMI : perl (ALAS-2019-1180)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Amazon Linux AMI Security Advisory ALAS-2019-1180. # include("compat.inc"); if (description) { script_id(123088); script_version("1.2"); script_cvs_date("Date: 2020/02/03"); script_cve_id("CVE-2018-18311"); script_xref(name:"ALAS", value:"2019-1180"); script_name(english:"Amazon Linux AMI : perl (ALAS-2019-1180)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote Amazon Linux AMI host is missing a security update." ); script_set_attribute( attribute:"description", value: "Perl has a buffer overflow via a crafted regular expression that triggers invalid write operations. (CVE-2018-18311)" ); script_set_attribute( attribute:"see_also", value:"https://alas.aws.amazon.com/ALAS-2019-1180.html" ); script_set_attribute( attribute:"solution", value:"Run 'yum update perl' to update your system." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perl-CPAN"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perl-ExtUtils-CBuilder"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perl-ExtUtils-Embed"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perl-ExtUtils-Install"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perl-IO-Zlib"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perl-Locale-Maketext-Simple"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perl-Module-CoreList"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perl-Module-Loaded"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perl-Object-Accessor"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perl-Package-Constants"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perl-Pod-Escapes"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perl-Time-Piece"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perl-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perl-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perl-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perl-libs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perl-macros"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:perl-tests"); script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux"); script_set_attribute(attribute:"vuln_publication_date", value:"2018/12/07"); script_set_attribute(attribute:"patch_publication_date", value:"2019/03/25"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/03/26"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Amazon Linux Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/AmazonLinux/release"); if (isnull(release) \|\| !strlen(release)) audit(AUDIT_OS_NOT, "Amazon Linux"); os_ver = pregmatch(pattern: "^AL(A\|\d)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux"); os_ver = os_ver[1]; if (os_ver != "A") { if (os_ver == 'A') os_ver = 'AMI'; audit(AUDIT_OS_NOT, "Amazon Linux AMI", "Amazon Linux " + os_ver); } if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (rpm_check(release:"ALA", reference:"perl-5.16.3-294.43.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"perl-CPAN-1.9800-294.43.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"perl-ExtUtils-CBuilder-0.28.2.6-294.43.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"perl-ExtUtils-Embed-1.30-294.43.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"perl-ExtUtils-Install-1.58-294.43.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"perl-IO-Zlib-1.10-294.43.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"perl-Locale-Maketext-Simple-0.21-294.43.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"perl-Module-CoreList-2.76.02-294.43.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"perl-Module-Loaded-0.08-294.43.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"perl-Object-Accessor-0.42-294.43.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"perl-Package-Constants-0.02-294.43.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"perl-Pod-Escapes-1.04-294.43.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"perl-Time-Piece-1.20.1-294.43.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"perl-core-5.16.3-294.43.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"perl-debuginfo-5.16.3-294.43.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"perl-devel-5.16.3-294.43.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"perl-libs-5.16.3-294.43.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"perl-macros-5.16.3-294.43.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"perl-tests-5.16.3-294.43.amzn1")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "perl / perl-CPAN / perl-ExtUtils-CBuilder / perl-ExtUtils-Embed / etc"); }

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-3834-1.NASL
description	Jayakrishna Menon discovered that Perl incorrectly handled Perl_my_setenv. An attacker could use this issue to cause Perl to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-18311) Eiichi Tsukata discovered that Perl incorrectly handled certain regular expressions. An attacker could use this issue to cause Perl to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 18.10. (CVE-2018-18312) Eiichi Tsukata discovered that Perl incorrectly handled certain regular expressions. An attacker could use this issue to cause Perl to crash, resulting in a denial of service. (CVE-2018-18313) Jakub Wilk discovered that Perl incorrectly handled certain regular expressions. An attacker could use this issue to cause Perl to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 18.10. (CVE-2018-18314). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-13
modified	2018-12-04
plugin id	119337
published	2018-12-04
reporter	Ubuntu Security Notice (C) 2018-2020 Canonical, Inc. / NASL script (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/119337
title	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 18.10 : perl vulnerabilities (USN-3834-1)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Ubuntu Security Notice USN-3834-1. The text # itself is copyright (C) Canonical, Inc. See # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered # trademark of Canonical, Inc. # include("compat.inc"); if (description) { script_id(119337); script_version("1.6"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/19"); script_cve_id("CVE-2018-18311", "CVE-2018-18312", "CVE-2018-18313", "CVE-2018-18314"); script_xref(name:"USN", value:"3834-1"); script_xref(name:"IAVA", value:"2018-A-0407-S"); script_name(english:"Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 18.10 : perl vulnerabilities (USN-3834-1)"); script_summary(english:"Checks dpkg output for updated package."); script_set_attribute( attribute:"synopsis", value:"The remote Ubuntu host is missing a security-related patch." ); script_set_attribute( attribute:"description", value: "Jayakrishna Menon discovered that Perl incorrectly handled Perl_my_setenv. An attacker could use this issue to cause Perl to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-18311) Eiichi Tsukata discovered that Perl incorrectly handled certain regular expressions. An attacker could use this issue to cause Perl to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 18.10. (CVE-2018-18312) Eiichi Tsukata discovered that Perl incorrectly handled certain regular expressions. An attacker could use this issue to cause Perl to crash, resulting in a denial of service. (CVE-2018-18313) Jakub Wilk discovered that Perl incorrectly handled certain regular expressions. An attacker could use this issue to cause Perl to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 18.10. (CVE-2018-18314). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://usn.ubuntu.com/3834-1/" ); script_set_attribute(attribute:"solution", value:"Update the affected perl package."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:perl"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:14.04"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.04"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:18.04:-:lts"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:18.10"); script_set_attribute(attribute:"vuln_publication_date", value:"2018/12/05"); script_set_attribute(attribute:"patch_publication_date", value:"2018/12/03"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/12/04"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_set_attribute(attribute:"stig_severity", value:"I"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"Ubuntu Security Notice (C) 2018-2020 Canonical, Inc. / NASL script (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Ubuntu Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("ubuntu.inc"); include("misc_func.inc"); if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/Ubuntu/release"); if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu"); release = chomp(release); if (! preg(pattern:"^(14\.04\|16\.04\|18\.04\|18\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 14.04 / 16.04 / 18.04 / 18.10", "Ubuntu " + release); if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu); flag = 0; if (ubuntu_check(osver:"14.04", pkgname:"perl", pkgver:"5.18.2-2ubuntu1.7")) flag++; if (ubuntu_check(osver:"16.04", pkgname:"perl", pkgver:"5.22.1-9ubuntu0.6")) flag++; if (ubuntu_check(osver:"18.04", pkgname:"perl", pkgver:"5.26.1-6ubuntu0.3")) flag++; if (ubuntu_check(osver:"18.10", pkgname:"perl", pkgver:"5.26.2-7ubuntu0.1")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : ubuntu_report_get() ); exit(0); } else { tested = ubuntu_pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "perl"); }

NASL family	Scientific Linux Local Security Checks
NASL id	SL_20190122_PERL_ON_SL7_X.NASL
description	Security Fix(es) : - perl: Integer overflow leading to buffer overflow in Perl_my_setenv() (CVE-2018-18311)
last seen	2020-03-18
modified	2019-01-23
plugin id	121326
published	2019-01-23
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/121326
title	Scientific Linux Security Update : perl on SL7.x x86_64 (20190122)

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-1238.NASL
description	According to the version of the perl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.i1/4^CVE-2018-18311i1/4%0 Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-03-19
modified	2019-04-04
plugin id	123706
published	2019-04-04
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/123706
title	EulerOS Virtualization 2.5.4 : perl (EulerOS-SA-2019-1238)

NASL family	PhotonOS Local Security Checks
NASL id	PHOTONOS_PHSA-2019-1_0-0212_LIBSOLV.NASL
description	An update of the libsolv package has been released.
last seen	2020-06-01
modified	2020-06-02
plugin id	122921
published	2019-03-18
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/122921
title	Photon OS 1.0: Libsolv PHSA-2019-1.0-0212

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2019-2264-1.NASL
description	This update for perl fixes the following issues : Security issue fixed : CVE-2018-18311: Fixed integer overflow with oversize environment (bsc#1114674). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	128471
published	2019-09-03
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/128471
title	SUSE SLED12 / SLES12 Security Update : perl (SUSE-SU-2019:2264-1)

NASL family	Gentoo Local Security Checks
NASL id	GENTOO_GLSA-201909-01.NASL
description	The remote host is affected by the vulnerability described in GLSA-201909-01 (Perl: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Perl. Please review the CVE identifiers referenced below for details. Impact : Please review the referenced CVE identifiers for details. Workaround : There is no known workaround at this time.
last seen	2020-06-01
modified	2020-06-02
plugin id	128590
published	2019-09-09
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/128590
title	GLSA-201909-01 : Perl: Multiple vulnerabilities

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DLA-1601.NASL
description	Jayakrishna Menon and Christophe Hauser discovered an integer overflow vulnerability in Perl_my_setenv leading to a heap-based buffer overflow with attacker-controlled input. For Debian 8
last seen	2020-06-01
modified	2020-06-02
plugin id	119311
published	2018-12-01
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/119311
title	Debian DLA-1601-1 : perl security update

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2019-1029.NASL
description	This update for perl fixes the following issues : Secuirty issues fixed : - CVE-2018-18311: Fixed integer overflow with oversize environment (bsc#1114674). - CVE-2018-18312: Fixed heap-buffer-overflow write / reg_node overrun (bsc#1114675). - CVE-2018-18313: Fixed heap-buffer-overflow read if regex contains \0 chars (bsc#1114681). - CVE-2018-18314: Fixed heap-buffer-overflow in regex (bsc#1114686). This update was imported from the SUSE:SLE-15:Update update project.
last seen	2020-06-01
modified	2020-06-02
plugin id	123159
published	2019-03-27
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/123159
title	openSUSE Security Update : perl (openSUSE-2019-1029)

NASL family	NewStart CGSL Local Security Checks
NASL id	NEWSTART_CGSL_NS-SA-2019-0054_PERL.NASL
description	The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has perl packages installed that are affected by a vulnerability: - Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations. (CVE-2018-18311) Note that Nessus has not tested for this issue but has instead relied only on the application
last seen	2020-06-01
modified	2020-06-02
plugin id	127242
published	2019-08-12
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/127242
title	NewStart CGSL CORE 5.04 / MAIN 5.04 : perl Vulnerability (NS-SA-2019-0054)

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-1401.NASL
description	According to the version of the perl packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.i1/4^CVE-2018-18311i1/4%0 Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-03-19
modified	2019-05-14
plugin id	124904
published	2019-05-14
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/124904
title	EulerOS Virtualization for ARM 64 3.0.1.0 : perl (EulerOS-SA-2019-1401)

NASL family	Amazon Linux Local Security Checks
NASL id	AL2_ALAS-2019-1166.NASL
description	Perl has a buffer overflow via a crafted regular expression that triggers invalid write operations.(CVE-2018-18311)
last seen	2020-06-01
modified	2020-06-02
plugin id	122672
published	2019-03-08
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/122672
title	Amazon Linux 2 : perl (ALAS-2019-1166)

NASL family	Misc.
NASL id	ORACLE_ENTERPRISE_MANAGER_APR_2020_CPU.NASL
description	The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the April 2020 CPU advisory. - Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations. (CVE-2018-18311) - ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce. Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable. OpenSSL versions 1.1.1 and 1.1.0 are affected by this issue. Due to the limited scope of affected deployments this has been assessed as low severity and therefore we are not creating new releases at this time. Fixed in OpenSSL 1.1.1c (Affected 1.1.1-1.1.1b). Fixed in OpenSSL 1.1.0k (Affected 1.1.0-1.1.0j). (CVE-2019-1543) - Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Discovery Framework (Oracle OHS)). Supported versions that are affected are 13.2.0.0 and 13.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Enterprise Manager Base Platform. (CVE-2020-2961) Note that Nessus has not tested for this issue but has instead relied only on the application
last seen	2020-04-23
modified	2020-04-16
plugin id	135679
published	2020-04-16
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/135679
title	Oracle Enterprise Manager Cloud Control (Apr 2020 CPU)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2019-1942.NASL
description	An update for perl is now available for Red Hat Enterprise Linux 7.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Security Fix(es) : * perl: Integer overflow leading to buffer overflow in Perl_my_setenv() (CVE-2018-18311) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
last seen	2020-06-01
modified	2020-06-02
plugin id	127629
published	2019-08-12
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/127629
title	RHEL 7 : perl (RHSA-2019:1942)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2019-2400.NASL
description	An update for perl is now available for Red Hat Enterprise Linux 7.3 Advanced Update Support, Red Hat Enterprise Linux 7.3 Telco Extended Update Support, and Red Hat Enterprise Linux 7.3 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Security Fix(es) : * perl: Integer overflow leading to buffer overflow in Perl_my_setenv() (CVE-2018-18311) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
last seen	2020-06-01
modified	2020-06-02
plugin id	127717
published	2019-08-12
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/127717
title	RHEL 7 : perl (RHSA-2019:2400)

NASL family	PhotonOS Local Security Checks
NASL id	PHOTONOS_PHSA-2019-1_0-0212_PYTHON3.NASL
description	An update of the python3 package has been released.
last seen	2020-06-01
modified	2020-06-02
plugin id	122924
published	2019-03-18
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/122924
title	Photon OS 1.0: Python3 PHSA-2019-1.0-0212

NASL family	PhotonOS Local Security Checks
NASL id	PHOTONOS_PHSA-2019-1_0-0212_RSYSLOG.NASL
description	An update of the rsyslog package has been released.
last seen	2020-06-01
modified	2020-06-02
plugin id	122925
published	2019-03-18
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/122925
title	Photon OS 1.0: Rsyslog PHSA-2019-1.0-0212

NASL family	MacOS X Local Security Checks
NASL id	MACOS_10_14_4.NASL
description	The remote host is running a version of macOS / Mac OS X that is 10.14.x prior to 10.14.4. It is, therefore, affected by multiple vulnerabilities, including: - Mounting a maliciously crafted NFS network share may lead to arbitrary code execution with system privileges. (CVE-2019-8508) - An application may be able to execute arbitrary code with kernel privileges. (CVE-2019-8529) - A malicious application may be able to execute arbitrary code with system privileges (CVE-2019-8549)
last seen	2020-06-01
modified	2020-06-02
plugin id	123128
published	2019-03-27
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/123128
title	macOS 10.14.x < 10.14.4 Multiple Vulnerabilities

NASL family	MacOS X Local Security Checks
NASL id	MACOS_SECUPD_10_13_6_2019-002.NASL
description	The remote host is running macOS 10.13.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities including: - An application may be able to execute arbitrary code with kernel privileges. (CVE-2019-8529) - A local user may be able to read kernel memory. (CVE-2019-8504) - A malicious application may be able to determine kernel memory layout. (CVE-2019-6207, CVE-2019-8510) - 802.1X - DiskArbitration - Feedback Assistant - IOKit - IOKit SCSI - Kernel - PackageKit - Perl - Security - Time Machine - Wi-Fi
last seen	2020-03-18
modified	2019-03-27
plugin id	123130
published	2019-03-27
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/123130
title	macOS 10.13.6 Multiple Vulnerabilities (Security Update 2019-002)

NASL family	MacOS X Local Security Checks
NASL id	MACOS_SECUPD_10_12_6_2019-002.NASL
description	The remote host is running Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities including: - A malicious application may be able to execute arbitrary code with kernel privileges. (CVE-2019-8555) - A malicious application may be able to determine kernel memory layout. (CVE-2019-6207, CVE-2019-8510) - A malicious application may be able to read restricted memory. (CVE-2019-8520) - 802.1X - DiskArbitration - Feedback Assistant - IOKit - IOKit SCSI - Kernel - PackageKit - Perl - Security - Time Machine - Wi-Fi
last seen	2020-06-01
modified	2020-06-02
plugin id	123129
published	2019-03-27
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/123129
title	macOS and Mac OS X Multiple Vulnerabilities (Security Update 2019-002)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DSA-4347.NASL
description	Multiple vulnerabilities were discovered in the implementation of the Perl programming language. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2018-18311 Jayakrishna Menon and Christophe Hauser discovered an integer overflow vulnerability in Perl_my_setenv leading to a heap-based buffer overflow with attacker-controlled input. - CVE-2018-18312 Eiichi Tsukata discovered that a crafted regular expression could cause a heap-based buffer overflow write during compilation, potentially allowing arbitrary code execution. - CVE-2018-18313 Eiichi Tsukata discovered that a crafted regular expression could cause a heap-based buffer overflow read during compilation which leads to information leak. - CVE-2018-18314 Jakub Wilk discovered that a specially crafted regular expression could lead to a heap-based buffer overflow.
last seen	2020-06-01
modified	2020-06-02
plugin id	119290
published	2018-11-30
reporter	This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/119290
title	Debian DSA-4347-1 : perl - security update

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2019-0109.NASL
description	From Red Hat Security Advisory 2019:0109 : An update for perl is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Security Fix(es) : * perl: Integer overflow leading to buffer overflow in Perl_my_setenv() (CVE-2018-18311) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank the Perl project for reporting this issue. Upstream acknowledges Jayakrishna Menon as the original reporter.
last seen	2020-03-18
modified	2019-01-22
plugin id	121279
published	2019-01-22
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/121279
title	Oracle Linux 7 : perl (ELSA-2019-0109)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-4187-1.NASL
description	This update for perl fixes the following issues : Secuirty issues fixed : CVE-2018-18311: Fixed integer overflow with oversize environment (bsc#1114674). CVE-2018-18312: Fixed heap-buffer-overflow write / reg_node overrun (bsc#1114675). CVE-2018-18313: Fixed heap-buffer-overflow read if regex contains \0 chars (bsc#1114681). CVE-2018-18314: Fixed heap-buffer-overflow in regex (bsc#1114686). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-03-18
modified	2019-01-02
plugin id	120189
published	2019-01-02
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/120189
title	SUSE SLED15 / SLES15 Security Update : perl (SUSE-SU-2018:4187-1)

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-1464.NASL
description	According to the versions of the perl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.(CVE-2018-18311) - It was found that the Archive::Tar module did not properly sanitize symbolic links when extracting tar archives. An attacker, able to provide a specially crafted archive for processing, could use this flaw to write or overwrite arbitrary files in the context of the Perl interpreter.(CVE-2018-12015) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	124967
published	2019-05-14
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/124967
title	EulerOS Virtualization 3.0.1.0 : perl (EulerOS-SA-2019-1464)

NASL family	PhotonOS Local Security Checks
NASL id	PHOTONOS_PHSA-2019-1_0-0212_UTIL.NASL
description	An update of the util package has been released.
last seen	2020-06-01
modified	2020-06-02
plugin id	122926
published	2019-03-18
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/122926
title	Photon OS 1.0: Util PHSA-2019-1.0-0212

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2018-1595.NASL
description	This update for perl fixes the following issues : Secuirty issues fixed : - CVE-2018-18311: Fixed integer overflow with oversize environment (bsc#1114674). - CVE-2018-18312: Fixed heap-buffer-overflow write / reg_node overrun (bsc#1114675). - CVE-2018-18313: Fixed heap-buffer-overflow read if regex contains \0 chars (bsc#1114681). - CVE-2018-18314: Fixed heap-buffer-overflow in regex (bsc#1114686). This update was imported from the SUSE:SLE-15:Update update project.
last seen	2020-06-05
modified	2018-12-24
plugin id	119863
published	2018-12-24
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/119863
title	openSUSE Security Update : perl (openSUSE-2018-1595)

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-1039.NASL
description	According to the version of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.(CVE-2018-18311) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-05-06
modified	2019-02-15
plugin id	122212
published	2019-02-15
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/122212
title	EulerOS 2.0 SP5 : perl (EulerOS-SA-2019-1039)

NASL family	PhotonOS Local Security Checks
NASL id	PHOTONOS_PHSA-2019-1_0-0212_KEEPALIVED.NASL
description	An update of the keepalived package has been released.
last seen	2020-06-01
modified	2020-06-02
plugin id	122920
published	2019-03-18
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/122920
title	Photon OS 1.0: Keepalived PHSA-2019-1.0-0212

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2019-0109.NASL
description	An update for perl is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Security Fix(es) : * perl: Integer overflow leading to buffer overflow in Perl_my_setenv() (CVE-2018-18311) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank the Perl project for reporting this issue. Upstream acknowledges Jayakrishna Menon as the original reporter.
last seen	2020-03-18
modified	2019-01-22
plugin id	121280
published	2019-01-22
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/121280
title	RHEL 7 : perl (RHSA-2019:0109)

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2019-0109.NASL
description	An update for perl is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Security Fix(es) : * perl: Integer overflow leading to buffer overflow in Perl_my_setenv() (CVE-2018-18311) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank the Perl project for reporting this issue. Upstream acknowledges Jayakrishna Menon as the original reporter.
last seen	2020-03-17
modified	2019-01-25
plugin id	121371
published	2019-01-25
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/121371
title	CentOS 7 : perl (CESA-2019:0109)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2018-9DBE983805.NASL
description	Security fix for CVE-2018-18311, CVE-2018-18312, CVE-2018-18313 and CVE-2018-18314 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-05
modified	2019-01-03
plugin id	120656
published	2019-01-03
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/120656
title	Fedora 29 : 4:perl (2018-9dbe983805)

NASL family	PhotonOS Local Security Checks
NASL id	PHOTONOS_PHSA-2019-2_0-0135_PERL.NASL
description	An update of the perl package has been released.
last seen	2020-06-01
modified	2020-06-02
plugin id	122912
published	2019-03-18
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/122912
title	Photon OS 2.0: Perl PHSA-2019-2.0-0135

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-1099.NASL
description	According to the version of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.(CVE-2018-18311) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-05-06
modified	2019-03-26
plugin id	123112
published	2019-03-26
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/123112
title	EulerOS 2.0 SP3 : perl (EulerOS-SA-2019-1099)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2019-1790.NASL
description	An update for perl is now available for Red Hat Enterprise Linux 7.5 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Security Fix(es) : * perl: Integer overflow leading to buffer overflow in Perl_my_setenv() (CVE-2018-18311) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
last seen	2020-06-01
modified	2020-06-02
plugin id	126758
published	2019-07-17
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/126758
title	RHEL 7 : perl (RHSA-2019:1790)

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-1239.NASL
description	According to the version of the perl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.i1/4^CVE-2018-18311i1/4%0 Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-03-19
modified	2019-04-04
plugin id	123707
published	2019-04-04
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/123707
title	EulerOS Virtualization 2.5.3 : perl (EulerOS-SA-2019-1239)

NASL family	PhotonOS Local Security Checks
NASL id	PHOTONOS_PHSA-2019-1_0-0212_PERL.NASL
description	An update of the perl package has been released.
last seen	2020-06-01
modified	2020-06-02
plugin id	122923
published	2019-03-18
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/122923
title	Photon OS 1.0: Perl PHSA-2019-1.0-0212

Redhat

advisories

bugzilla

id	1646730
title	CVE-2018-18311 perl: Integer overflow leading to buffer overflow in Perl_my_setenv()

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 7 is installed
oval oval:com.redhat.rhba:tst:20150364027

AND
comment perl-tests is earlier than 4:5.16.3-294.el7_6
oval oval:com.redhat.rhsa:tst:20190109001
comment perl-tests is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20190109002
AND
comment perl is earlier than 4:5.16.3-294.el7_6
oval oval:com.redhat.rhsa:tst:20190109003
comment perl is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110558076
AND
comment perl-devel is earlier than 4:5.16.3-294.el7_6
oval oval:com.redhat.rhsa:tst:20190109005
comment perl-devel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110558050
AND
comment perl-libs is earlier than 4:5.16.3-294.el7_6
oval oval:com.redhat.rhsa:tst:20190109007
comment perl-libs is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110558040

AND

comment perl-Time-Piece is earlier than 0:1.20.1-294.el7_6
oval oval:com.redhat.rhsa:tst:20190109009
comment perl-Time-Piece is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110558014

AND
comment perl-macros is earlier than 4:5.16.3-294.el7_6
oval oval:com.redhat.rhsa:tst:20190109011
comment perl-macros is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20190109012
AND
comment perl-core is earlier than 0:5.16.3-294.el7_6
oval oval:com.redhat.rhsa:tst:20190109013
comment perl-core is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110558022
AND
comment perl-CPAN is earlier than 0:1.9800-294.el7_6
oval oval:com.redhat.rhsa:tst:20190109015
comment perl-CPAN is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110558082

AND

comment perl-Object-Accessor is earlier than 1:0.42-294.el7_6
oval oval:com.redhat.rhsa:tst:20190109017
comment perl-Object-Accessor is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110558046

AND

comment perl-ExtUtils-Install is earlier than 0:1.58-294.el7_6
oval oval:com.redhat.rhsa:tst:20190109019
comment perl-ExtUtils-Install is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20190109020

AND

comment perl-Locale-Maketext-Simple is earlier than 1:0.21-294.el7_6
oval oval:com.redhat.rhsa:tst:20190109021
comment perl-Locale-Maketext-Simple is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110558004

AND

comment perl-Module-CoreList is earlier than 1:2.76.02-294.el7_6
oval oval:com.redhat.rhsa:tst:20190109023
comment perl-Module-CoreList is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110558066

AND

comment perl-Package-Constants is earlier than 1:0.02-294.el7_6
oval oval:com.redhat.rhsa:tst:20190109025
comment perl-Package-Constants is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110558026

AND

comment perl-ExtUtils-Embed is earlier than 0:1.30-294.el7_6
oval oval:com.redhat.rhsa:tst:20190109027
comment perl-ExtUtils-Embed is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110558020

AND

comment perl-Pod-Escapes is earlier than 1:1.04-294.el7_6
oval oval:com.redhat.rhsa:tst:20190109029
comment perl-Pod-Escapes is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110558032

AND
comment perl-IO-Zlib is earlier than 1:1.10-294.el7_6
oval oval:com.redhat.rhsa:tst:20190109031
comment perl-IO-Zlib is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110558028

AND

comment perl-ExtUtils-CBuilder is earlier than 1:0.28.2.6-294.el7_6
oval oval:com.redhat.rhsa:tst:20190109033
comment perl-ExtUtils-CBuilder is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110558074

AND

comment perl-Module-Loaded is earlier than 1:0.08-294.el7_6
oval oval:com.redhat.rhsa:tst:20190109035
comment perl-Module-Loaded is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110558062

rhsa

id	RHSA-2019:0109
released	2019-01-21
severity	Important
title	RHSA-2019:0109: perl security update (Important)

rhsa
id RHBA-2019:0327
rhsa
id RHSA-2019:0001
rhsa
id RHSA-2019:0010
rhsa
id RHSA-2019:1790
rhsa
id RHSA-2019:1942
rhsa
id RHSA-2019:2400

rpms

rh-perl526-perl-4:5.26.3-405.el7
rh-perl526-perl-Attribute-Handlers-0:0.99-405.el7
rh-perl526-perl-Devel-Peek-0:1.26-405.el7
rh-perl526-perl-Devel-SelfStubber-0:1.06-405.el7
rh-perl526-perl-Errno-0:1.28-405.el7
rh-perl526-perl-ExtUtils-Embed-0:1.34-405.el7
rh-perl526-perl-ExtUtils-Miniperl-0:1.06-405.el7
rh-perl526-perl-IO-0:1.38-405.el7
rh-perl526-perl-IO-Zlib-1:1.10-405.el7
rh-perl526-perl-Locale-Maketext-Simple-1:0.21-405.el7
rh-perl526-perl-Math-Complex-0:1.59-405.el7
rh-perl526-perl-Memoize-0:1.03-405.el7
rh-perl526-perl-Module-CoreList-1:5.20181130-1.el7
rh-perl526-perl-Module-CoreList-tools-1:5.20181130-1.el7
rh-perl526-perl-Module-Loaded-1:0.08-405.el7
rh-perl526-perl-Net-Ping-0:2.55-405.el7
rh-perl526-perl-Pod-Html-0:1.22.02-405.el7
rh-perl526-perl-SelfLoader-0:1.23-405.el7
rh-perl526-perl-Test-0:1.30-405.el7
rh-perl526-perl-Time-Piece-0:1.31-405.el7
rh-perl526-perl-debuginfo-4:5.26.3-405.el7
rh-perl526-perl-devel-4:5.26.3-405.el7
rh-perl526-perl-interpreter-4:5.26.3-405.el7
rh-perl526-perl-libnetcfg-4:5.26.3-405.el7
rh-perl526-perl-libs-4:5.26.3-405.el7
rh-perl526-perl-macros-4:5.26.3-405.el7
rh-perl526-perl-open-0:1.11-405.el7
rh-perl526-perl-tests-4:5.26.3-405.el7
rh-perl526-perl-utils-0:5.26.3-405.el7
rh-perl524-perl-4:5.24.0-381.el6
rh-perl524-perl-4:5.24.0-381.el7
rh-perl524-perl-Attribute-Handlers-0:0.99-381.el6
rh-perl524-perl-Attribute-Handlers-0:0.99-381.el7
rh-perl524-perl-Devel-Peek-0:1.23-381.el6
rh-perl524-perl-Devel-Peek-0:1.23-381.el7
rh-perl524-perl-Devel-SelfStubber-0:1.05-381.el6
rh-perl524-perl-Devel-SelfStubber-0:1.05-381.el7
rh-perl524-perl-Errno-0:1.25-381.el6
rh-perl524-perl-Errno-0:1.25-381.el7
rh-perl524-perl-ExtUtils-Embed-0:1.33-381.el6
rh-perl524-perl-ExtUtils-Embed-0:1.33-381.el7
rh-perl524-perl-ExtUtils-Miniperl-0:1.05-381.el6
rh-perl524-perl-ExtUtils-Miniperl-0:1.05-381.el7
rh-perl524-perl-IO-0:1.36-381.el6
rh-perl524-perl-IO-0:1.36-381.el7
rh-perl524-perl-IO-Zlib-1:1.10-381.el6
rh-perl524-perl-IO-Zlib-1:1.10-381.el7
rh-perl524-perl-Locale-Maketext-Simple-1:0.21-381.el6
rh-perl524-perl-Locale-Maketext-Simple-1:0.21-381.el7
rh-perl524-perl-Math-BigInt-FastCalc-0:0.40-381.el6
rh-perl524-perl-Math-BigInt-FastCalc-0:0.40-381.el7
rh-perl524-perl-Math-BigRat-0:0.2608.02-381.el6
rh-perl524-perl-Math-BigRat-0:0.2608.02-381.el7
rh-perl524-perl-Math-Complex-0:1.59-381.el6
rh-perl524-perl-Math-Complex-0:1.59-381.el7
rh-perl524-perl-Memoize-0:1.03-381.el6
rh-perl524-perl-Memoize-0:1.03-381.el7
rh-perl524-perl-Module-Loaded-1:0.08-381.el6
rh-perl524-perl-Module-Loaded-1:0.08-381.el7
rh-perl524-perl-Net-Ping-0:2.43-381.el6
rh-perl524-perl-Net-Ping-0:2.43-381.el7
rh-perl524-perl-Pod-Html-0:1.22-381.el6
rh-perl524-perl-Pod-Html-0:1.22-381.el7
rh-perl524-perl-SelfLoader-0:1.23-381.el6
rh-perl524-perl-SelfLoader-0:1.23-381.el7
rh-perl524-perl-Test-0:1.28-381.el6
rh-perl524-perl-Test-0:1.28-381.el7
rh-perl524-perl-Time-Piece-0:1.31-381.el6
rh-perl524-perl-Time-Piece-0:1.31-381.el7
rh-perl524-perl-bignum-0:0.42-381.el6
rh-perl524-perl-bignum-0:0.42-381.el7
rh-perl524-perl-core-0:5.24.0-381.el6
rh-perl524-perl-core-0:5.24.0-381.el7
rh-perl524-perl-debuginfo-4:5.24.0-381.el6
rh-perl524-perl-debuginfo-4:5.24.0-381.el7
rh-perl524-perl-devel-4:5.24.0-381.el6
rh-perl524-perl-devel-4:5.24.0-381.el7
rh-perl524-perl-libnetcfg-4:5.24.0-381.el6
rh-perl524-perl-libnetcfg-4:5.24.0-381.el7
rh-perl524-perl-libs-4:5.24.0-381.el6
rh-perl524-perl-libs-4:5.24.0-381.el7
rh-perl524-perl-macros-4:5.24.0-381.el6
rh-perl524-perl-macros-4:5.24.0-381.el7
rh-perl524-perl-open-0:1.10-381.el6
rh-perl524-perl-open-0:1.10-381.el7
rh-perl524-perl-tests-4:5.24.0-381.el6
rh-perl524-perl-tests-4:5.24.0-381.el7
rh-perl524-perl-utils-0:5.24.0-381.el6
rh-perl524-perl-utils-0:5.24.0-381.el7
perl-4:5.16.3-294.el7_6
perl-CPAN-0:1.9800-294.el7_6
perl-ExtUtils-CBuilder-1:0.28.2.6-294.el7_6
perl-ExtUtils-Embed-0:1.30-294.el7_6
perl-ExtUtils-Install-0:1.58-294.el7_6
perl-IO-Zlib-1:1.10-294.el7_6
perl-Locale-Maketext-Simple-1:0.21-294.el7_6
perl-Module-CoreList-1:2.76.02-294.el7_6
perl-Module-Loaded-1:0.08-294.el7_6
perl-Object-Accessor-1:0.42-294.el7_6
perl-Package-Constants-1:0.02-294.el7_6
perl-Pod-Escapes-1:1.04-294.el7_6
perl-Time-Piece-0:1.20.1-294.el7_6
perl-core-0:5.16.3-294.el7_6
perl-debuginfo-4:5.16.3-294.el7_6
perl-devel-4:5.16.3-294.el7_6
perl-libs-4:5.16.3-294.el7_6
perl-macros-4:5.16.3-294.el7_6
perl-tests-4:5.16.3-294.el7_6
perl-4:5.16.3-292.el7_5.1
perl-CPAN-0:1.9800-292.el7_5.1
perl-ExtUtils-CBuilder-1:0.28.2.6-292.el7_5.1
perl-ExtUtils-Embed-0:1.30-292.el7_5.1
perl-ExtUtils-Install-0:1.58-292.el7_5.1
perl-IO-Zlib-1:1.10-292.el7_5.1
perl-Locale-Maketext-Simple-1:0.21-292.el7_5.1
perl-Module-CoreList-1:2.76.02-292.el7_5.1
perl-Module-Loaded-1:0.08-292.el7_5.1
perl-Object-Accessor-1:0.42-292.el7_5.1
perl-Package-Constants-1:0.02-292.el7_5.1
perl-Pod-Escapes-1:1.04-292.el7_5.1
perl-Time-Piece-0:1.20.1-292.el7_5.1
perl-core-0:5.16.3-292.el7_5.1
perl-debuginfo-4:5.16.3-292.el7_5.1
perl-devel-4:5.16.3-292.el7_5.1
perl-libs-4:5.16.3-292.el7_5.1
perl-macros-4:5.16.3-292.el7_5.1
perl-tests-4:5.16.3-292.el7_5.1
perl-4:5.16.3-292.el7_4.1
perl-CPAN-0:1.9800-292.el7_4.1
perl-ExtUtils-CBuilder-1:0.28.2.6-292.el7_4.1
perl-ExtUtils-Embed-0:1.30-292.el7_4.1
perl-ExtUtils-Install-0:1.58-292.el7_4.1
perl-IO-Zlib-1:1.10-292.el7_4.1
perl-Locale-Maketext-Simple-1:0.21-292.el7_4.1
perl-Module-CoreList-1:2.76.02-292.el7_4.1
perl-Module-Loaded-1:0.08-292.el7_4.1
perl-Object-Accessor-1:0.42-292.el7_4.1
perl-Package-Constants-1:0.02-292.el7_4.1
perl-Pod-Escapes-1:1.04-292.el7_4.1
perl-Time-Piece-0:1.20.1-292.el7_4.1
perl-core-0:5.16.3-292.el7_4.1
perl-debuginfo-4:5.16.3-292.el7_4.1
perl-devel-4:5.16.3-292.el7_4.1
perl-libs-4:5.16.3-292.el7_4.1
perl-macros-4:5.16.3-292.el7_4.1
perl-tests-4:5.16.3-292.el7_4.1
perl-4:5.16.3-291.el7_3.1
perl-CPAN-0:1.9800-291.el7_3.1
perl-ExtUtils-CBuilder-1:0.28.2.6-291.el7_3.1
perl-ExtUtils-Embed-0:1.30-291.el7_3.1
perl-ExtUtils-Install-0:1.58-291.el7_3.1
perl-IO-Zlib-1:1.10-291.el7_3.1
perl-Locale-Maketext-Simple-1:0.21-291.el7_3.1
perl-Module-CoreList-1:2.76.02-291.el7_3.1
perl-Module-Loaded-1:0.08-291.el7_3.1
perl-Object-Accessor-1:0.42-291.el7_3.1
perl-Package-Constants-1:0.02-291.el7_3.1
perl-Perl4-CoreLibs-0:0.001-291.el7_3.1
perl-Pod-Escapes-1:1.04-291.el7_3.1
perl-Time-Piece-0:1.20.1-291.el7_3.1
perl-core-0:5.16.3-291.el7_3.1
perl-debuginfo-4:5.16.3-291.el7_3.1
perl-devel-4:5.16.3-291.el7_3.1
perl-libs-4:5.16.3-291.el7_3.1
perl-macros-4:5.16.3-291.el7_3.1
perl-tests-4:5.16.3-291.el7_3.1

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

Nessus

Redhat

References