CVE-2024-56406

Publication date 13 April 2025

Last updated 16 April 2025

Ubuntu priority

A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`. $ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;' Segmentation fault (core dumped) It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
perl	24.10 oracular	Fixed 5.38.2-5ubuntu0.1
	24.04 LTS noble	Fixed 5.38.2-3.2ubuntu0.1
	22.04 LTS jammy	Fixed 5.34.0-3ubuntu1.4
	20.04 LTS focal	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not affected

Notes

mdeslaur

introduced by: https://github.com/Perl/perl5/commit/a311ee08b6781f83a7785f578a26bbc21a7ae457

CVE-2024-56406

Status

Notes

mdeslaur

References

Related Ubuntu Security Notices (USN)

Other references