CVE-2018-18313
- Source
- https://cve.org/CVERecord?id=CVE-2018-18313
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-18313.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2018-18313
- Downstream
- Related
- Published
- 2018-12-07T21:29:00.717Z
- Modified
- 2026-04-11T12:27:57.672742Z
- Severity
-
- 9.1 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.
- References
-
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM/
- https://www.oracle.com/security-alerts/cpujul2020.html
- http://www.securitytracker.com/id/1042181
- https://metacpan.org/changes/release/SHAY/perl-5.26.3
- https://security.gentoo.org/glsa/201909-01
- https://security.netapp.com/advisory/ntap-20190221-0003/
- https://support.apple.com/kb/HT209600
- https://seclists.org/bugtraq/2019/Mar/42
- https://usn.ubuntu.com/3834-1/
- https://www.debian.org/security/2018/dsa-4347
- http://seclists.org/fulldisclosure/2019/Mar/49
- https://access.redhat.com/errata/RHSA-2019:0010
- https://access.redhat.com/errata/RHSA-2019:0001
- https://usn.ubuntu.com/3834-2/
- https://bugzilla.redhat.com/show_bug.cgi?id=1646738
- https://github.com/Perl/perl5/commit/43b2f4ef399e2fd7240b4eeb0658686ad95f8e62
- https://rt.perl.org/Ticket/Display.html?id=133192
Affected packages
Git / github.com/perl/perl5
Affected versions
Other
GitLive-blead
perl-5a2
perl-5a9
if-0.*
if-0.0603
if-0.0604
if-0.0605
perl-1.*
perl-1.0
perl-2.*
perl-2.0
perl-3.*
perl-3.000
perl-3.044
perl-4.*
perl-4.0.00
perl-4.0.36
perl-5.*
perl-5.000
perl-5.000o
perl-5.001
perl-5.001n
perl-5.002
perl-5.002_01
perl-5.003
perl-5.005
perl-5.6.0
perl-5.7.0
perl-5.7.1
perl-5.7.2
perl-5.7.3
perl-5.8.0
perl-5.9.0
perl-5.9.1
perl-5.9.2
perl-5.9.3
perl-5.9.4
perl-5.9.5
v5.*
v5.10.0
v5.11.0
v5.11.1
v5.11.3
v5.11.4
v5.11.5
v5.12.0
v5.12.0-RC0
v5.12.0-RC1
v5.12.0-RC2
v5.12.0-RC3
v5.12.0-RC4
v5.12.0-RC5
v5.13.0
v5.13.1
v5.13.10
v5.13.11
v5.13.2
v5.13.3
v5.13.4
v5.13.5
v5.13.6
v5.13.7
v5.13.8
v5.13.9
v5.14.0
v5.14.0-RC1
v5.14.0-RC2
v5.14.0-RC3
v5.15.0
v5.15.1
v5.15.2
v5.15.3
v5.15.4
v5.15.5
v5.15.9
v5.16.0
v5.16.0-RC1
v5.16.0-RC2
v5.17.0
v5.17.2
v5.17.4
v5.17.6
v5.17.7
v5.17.7.0
v5.17.8
v5.17.9
v5.18.0
v5.18.0-RC1
v5.18.0-RC2
v5.18.0-RC3
v5.18.0-RC4
v5.19.0
v5.19.1
v5.19.11
v5.19.2
v5.19.3
v5.19.5
v5.19.7
v5.20.0
v5.20.0-RC1
v5.21.0
v5.21.1
v5.21.10
v5.21.11
v5.21.4
v5.21.5
v5.21.6
v5.21.8
v5.21.9
v5.22.0
v5.22.0-RC1
v5.22.0-RC2
v5.23.0
v5.23.1
v5.23.2
v5.23.3
v5.23.4
v5.23.6
v5.23.7
v5.24.0
v5.24.0-RC1
v5.24.0-RC2
v5.24.0-RC3
v5.24.0-RC4
v5.24.0-RC5
v5.25.0
v5.25.11
v5.25.2
v5.25.3
v5.25.4
v5.25.5
v5.25.7
v5.25.9
v5.26.0
v5.26.0-RC2
v5.26.1
v5.26.1-RC1
v5.26.2
v5.26.2-RC1
v5.26.3-RC1
v5.27.0
v5.27.3
v5.27.5
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-18313.json"
vanir_signatures
[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"101663868690937553214163442339379018565",
"59784038656455587243834010724958712382",
"28653314884608291336798897290106167798",
"96782067870058283391976206744121659574",
"162305355118608742235120534489597881333",
"127016832599108291182225561584131541991",
"249628749345757174872968758037840711806",
"288202923974203869187008973508210421650",
"259826910144805988136646004747213420863",
"87602121002291453069095856109041256948",
"165962808217590646015153787518747062719",
"169368250554995426997668874526762561190",
"317752557994194264263538380391852906952",
"232794246500132610966781115686424671305"
]
},
"id": "CVE-2018-18313-0a4ef1d6",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/perl/perl5/commit/43b2f4ef399e2fd7240b4eeb0658686ad95f8e62",
"target": {
"file": "regcomp.c"
}
},
{
"digest": {
"length": 16823.0,
"function_hash": "83938533586342320801161483788721225942"
},
"id": "CVE-2018-18313-3fc0e987",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/perl/perl5/commit/43b2f4ef399e2fd7240b4eeb0658686ad95f8e62",
"target": {
"function": "S_regatom",
"file": "regcomp.c"
}
},
{
"digest": {
"length": 26791.0,
"function_hash": "256924597074835678896577529209401787607"
},
"id": "CVE-2018-18313-88bce564",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/perl/perl5/commit/43b2f4ef399e2fd7240b4eeb0658686ad95f8e62",
"target": {
"function": "S_regclass",
"file": "regcomp.c"
}
},
{
"digest": {
"length": 3419.0,
"function_hash": "63122755006878456440416897999935609546"
},
"id": "CVE-2018-18313-8c7e952f",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/perl/perl5/commit/43b2f4ef399e2fd7240b4eeb0658686ad95f8e62",
"target": {
"function": "S_grok_bslash_N",
"file": "regcomp.c"
}
}
]
vanir_signatures_modified
"2026-04-11T12:27:57Z"
unresolved_ranges
[
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "12.04"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "14.04"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "16.04"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "18.04"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "18.10"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "6.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "7.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "7.4"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "7.5"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "7.6"
}
]
},
{
"events": [
{
"introduced": "11.0"
},
{
"last_affected": "11.40"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.14.4"
}
]
}
]