CVE-2017-12814

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 on Windows allows attackers to execute arbitrary code via a long environment variable.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/101051Third Party Advisory, VDB Entry
https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1Release Notes, Vendor Advisory
https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1Release Notes, Vendor Advisory
https://rt.perl.org/Public/Bug/Display.html?id=131665Exploit, Patch, Vendor Advisory
https://security.netapp.com/advisory/ntap-20180426-0001/
https://www.oracle.com/security-alerts/cpujul2020.html
http://www.securityfocus.com/bid/101051Third Party Advisory, VDB Entry
https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1Release Notes, Vendor Advisory
https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1Release Notes, Vendor Advisory
https://rt.perl.org/Public/Bug/Display.html?id=131665Exploit, Patch, Vendor Advisory
https://security.netapp.com/advisory/ntap-20180426-0001/
https://www.oracle.com/security-alerts/cpujul2020.html

Timeline

Published: Sep 28, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-1281510.0Analysis of the Bomgar Remote Support Portal JavaStart.jar Applet 52790 and earlier revealed that it is vulnerable to a path traversal vulne CVE-2017-128169.8In Kaspersky Internet Security for Android 11.12.4.1622, some of application exports activities have weak permissions, which might be used b CVE-2017-128177.5In Kaspersky Internet Security for Android 11.12.4.1622, some of the application trace files were not encrypted.CVE-2017-128187.5Stack overflow in custom XML-parser in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 le CVE-2017-128199.8Remote manipulations with language pack updater lead to NTLM-relay attack for system user in Gemalto's HASP SRM, Sentinel HASP and Sentinel CVE-2017-12825.4IBM Content Navigator & CMIS 2.0 and 3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScrip CVE-2017-128207.5Arbitrary memory read from controlled memory pointer in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RT CVE-2017-128219.8Memory corruption in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 might cause remote c CVE-2017-128229.9Remote enabling and disabling admin interface in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE versi CVE-2017-128237.8Kernel pool memory corruption in one of drivers in Kaspersky Embedded Systems Security version 1.2.0.300 leads to local privilege escalation CVE-2017-128247.8Special crafted InPage document leads to arbitrary code execution in InPage reader.CVE-2017-12834.3IBM WebSphere MQ 8.0 and 9.0 could allow an authenticated user to cause a shared memory leak by MQ applications using dynamic queues, which