According to the versions of the perl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in perl. This issue occurs when a crafted regular expression is compiled by     perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.
    (CVE-2023-47038)

  - In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a     property name associated with a \p{...} regular expression construct is mishandled. The earliest affected     version is 5.30.0. (CVE-2023-47100)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

したがって、ALAS2023-2023-448 のアドバイザリに記載されている複数の脆弱性の影響を受けます。

  - perl に、脆弱性が見つかりました。この問題は、細工された正規表現が perl でコンパイルされた場合に発生し、攻撃者がヒープに割り当てられたバッファで制御されたバイトバッファオーバーフローを引き起こす可能性があります。
    (CVE-2023-47038)

  - 5.38.2 より前の Perl では、\p{...} 正規表現構造に関連付けられたプロパティ名が不適切に処理されるため、regcomp.c の S_parse_uniprop_string が未割り当てスペースに書き込む可能性があります。影響を受ける最も古いバージョンは 5.30.0です。(CVE-2023-47100)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

因此，會受到 ALAS2023-2023-448 公告中所提及的多個弱點影響。

  - 在 perl 中發現一個弱點。當 perl 編譯特製的規則運算式時，會發生此問題，進而導致在堆積配置的緩衝區中發生攻擊者控制的位元組緩衝區溢位。
    (CVE-2023-47038)

  - 在 5.38.2 版之前的 Perl 中，regcomp.c 的 S_parse_uniprop_string 可寫入未配置的空間，出現此問題的原因是與 \p{...} 規則運算式建構相關聯的內容名稱處理不當。最早的受影響版本是 5.30.0。(CVE-2023-47100)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

因此，它受到 ALAS2023-2023-448 公告中提及的多个漏洞影响。

  - 在 perl 中发现一个漏洞。当 perl 编译构建的正则表达式时会出现此问题，攻击者可借此在堆栈分配缓冲区中造成受控字节缓冲区溢出。
    (CVE-2023-47038)

  - 在低于 5.38.2 的 Perl 中，regcomp.c 中的 S_parse_uniprop_string 可写入未分配空间，这是由于错误处理与 \p{...} 正则表达式构造相关的属性名称所致。低于 5.30.0 的版本均受影响。(CVE-2023-47100)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in perl. This issue occurs when a crafted regular expression is compiled by     perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.
    (CVE-2023-47038)

  - In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a     property name associated with a \p{...} regular expression construct is mishandled. The earliest affected     version is 5.30.0. (CVE-2023-47100)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-448 advisory.

    2024-02-01: CVE-2023-47100 was added to this advisory.

    A crafted regular expression when compiled by perl 5.30.0 through 5.38.0 can cause a one-byte attacker     controlled buffer overflow in a heap allocated buffer. (CVE-2023-47038)

    In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a     property name associated with a \p{...} regular expression construct is mishandled. The earliest affected     version is 5.30.0. (CVE-2023-47100)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the perl package has been released.

The remote NewStart CGSL host, running version MAIN 7.02, has perl packages installed that are affected by multiple vulnerabilities:

  - In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a     property name associated with a \p{...} regular expression construct is mishandled. The earliest affected     version is 5.30.0. (CVE-2023-47100)

  - A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular     expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap     allocated buffer. (CVE-2023-47038)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
192343	EulerOS Virtualization 2.11.0 : perl (EulerOS-SA-2024-1446)	Nessus	Huawei Local Security Checks	2024/3/21	2024/3/21	critical
186976	Amazon Linux 2023 : perl、perl-Attribute-Handlers、perl-AutoLoader (ALAS2023-2023-448)	Nessus	Amazon Linux Local Security Checks	2023/12/15	2024/12/11	critical
186976	Amazon Linux 2023：perl、perl-Attribute-Handlers、perl-AutoLoader (ALAS2023-2023-448)	Nessus	Amazon Linux Local Security Checks	2023/12/15	2024/12/11	critical
186976	Amazon Linux 2023：perl、perl-Attribute-Handlers、perl-AutoLoader (ALAS2023-2023-448)	Nessus	Amazon Linux Local Security Checks	2023/12/15	2024/12/11	critical
189702	EulerOS 2.0 SP11 : perl (EulerOS-SA-2024-1126)	Nessus	Huawei Local Security Checks	2024/1/26	2024/1/26	critical
192337	EulerOS Virtualization 2.11.1 : perl (EulerOS-SA-2024-1418)	Nessus	Huawei Local Security Checks	2024/3/21	2024/3/21	critical
186976	Amazon Linux 2023 : perl, perl-Attribute-Handlers, perl-AutoLoader (ALAS2023-2023-448)	Nessus	Amazon Linux Local Security Checks	2023/12/15	2024/12/11	critical
189685	EulerOS 2.0 SP11 : perl (EulerOS-SA-2024-1110)	Nessus	Huawei Local Security Checks	2024/1/26	2024/1/26	critical
203645	Photon OS 4.0: Perl PHSA-2023-4.0-0528	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	critical
203532	Photon OS 5.0: Perl PHSA-2023-5.0-0168	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	critical
242757	NewStart CGSL MAIN 7.02 : perl Multiple Vulnerabilities (NS-SA-2025-0135)	Nessus	NewStart CGSL Local Security Checks	2025/7/25	2025/7/25	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical