CVE-2017-12883

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\N{U+...}' escape.

Metrics

CVSS 3.0 9.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-119

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Sep 19, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-128847.5OX Software GmbH App Suite 7.8.4 and earlier is affected by: Information Exposure.CVE-2017-128856.1OX Software GmbH App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).CVE-2017-12898.2IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection (XXE) error when processing XML data. A remote attacker could eCVE-2017-128927.8Foxit PDF Compressor installers from versions from 7.0.0.183 to 7.7.2.10 contain a DLL preloading vulnerability, wherein it is possible for CVE-2017-128939.8The SMB/CIFS parser in tcpdump before 4.9.2 has a buffer over-read in smbutil.c:name_len().CVE-2017-128949.8Several protocol parsers in tcpdump before 4.9.2 could cause a buffer over-read in addrtoname.c:lookup_bytestring().CVE-2017-128959.8The ICMP parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp.c:icmp_print().CVE-2017-128969.8The ISAKMP parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c:isakmp_rfc3948_print().CVE-2017-128979.8The ISO CLNS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:isoclns_print().CVE-2017-128989.8The NFS parser in tcpdump before 4.9.2 has a buffer over-read in print-nfs.c:interp_reply().CVE-2017-128999.8The DECnet parser in tcpdump before 4.9.2 has a buffer over-read in print-decnet.c:decnet_print().CVE-2017-12905.4IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaS
CVE-2017-12883: Critical severity, CVSS 9.1 | Vulnix