Description
Double free vulnerability in Perl 5.8.8 allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a crafted regular expression containing UTF8 characters. NOTE: this issue might only be present on certain operating systems.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | perl | 5.10.0-1 | — |
| Debian 13 | perl | 5.10.0-1 | — |
| Debian 12 | perl | 5.10.0-1 | — |
| Debian 4.0 | perl | 5.8.8-7etch3 | DSA-1556-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | perl +1 | 4:5.8.8-10.el5_2.3 | RHSA-2008:0522 |
| RHEL 4 | perl +1 | 3:5.8.5-36.el4_6.3 | RHSA-2008:0522 |
| RHEL 3 | perl +1 | 2:5.8.0-98.EL3 | RHSA-2008:0522 |
| RHEL 3 | perl-CGI | 2:2.89-98.EL3 | RHSA-2008:0522 |
| RHEL 3 | perl-CPAN | 2:1.61-98.EL3 | RHSA-2008:0522 |
| RHEL 3 | perl-DB_File | 2:1.806-98.EL3 | RHSA-2008:0522 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 1 | perl +1 | 4:5.8.8-6.el4s1_3 | RHSA-2008:0532 |
| Red Hat Certificate System 7 | ant | 1.6.5-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | avalon-logkit | 1.2-2jpp_4rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | axis | 1.2.1-1jpp_3rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | classpathx-jaf | 1.0-2jpp_6rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | classpathx-mail | 1.1.1-2jpp_8rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | geronimo-specs +10 | 1.0-0.M4.1jpp_10rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | jakarta-commons-modeler | 2.0-3jpp_2rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | log4j | 1.2.12-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | mx4j | 1:3.0.1-1jpp_4rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | pcsc-lite +2 | 1.3.3-3.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-ca | 7.3.0-20.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-java-tools | 7.3.0-10.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-kra | 7.3.0-14.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-manage | 7.3.0-19.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-native-tools | 7.3.0-6.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-tks +1 | 7.3.0-13.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | tomcat5 +5 | 5.5.23-0jpp_4rh.16 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | xerces-j2 | 2.7.1-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | xml-commons +1 | 1.3.02-2jpp_1rh | RHSA-2010:0602 |
Advisories 4
- RHSA-2010:0602 Red Hat Security Advisory: Red Hat Certificate System 7.3 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0522 Red Hat Security Advisory: perl security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1556-2 perl - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2008:0532 Red Hat Security Advisory: perl security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- SUSE-SR:2008:017 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-317.htm
- ADV-2008-2424 vdb-entry
- 31328 third-party-advisory
- FEDORA-2008-3399 vendor-advisory
- 44588 vdb-entry
- http://wiki.rpath.com/Advisories:rPSA-2009-0011
- 33937 third-party-advisory
- http://rt.perl.org/rt3/Public/Bug/Display.html?id=48156
- RHSA-2008:0532 vendor-advisory
- 31687 third-party-advisory
- perl-utf8-dos(41996) vdb-entry
- USN-700-1 vendor-advisory
- oval:org.mitre.oval:def:10579 vdb-entry signature
- http://support.apple.com/kb/HT3438
- 29948 third-party-advisory
- APPLE-SA-2009-02-12 vendor-advisory
- GLSA-200805-17 vendor-advisory
- 1020253 vdb-entry
- ADV-2008-2361 vdb-entry
- 31467 third-party-advisory
- RHSA-2008:0522 vendor-advisory
- FEDORA-2008-3392 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-361.htm
- 33314 third-party-advisory
- ADV-2009-0422 vdb-entry
- 31604 third-party-advisory
- http://www.vmware.com/security/advisories/VMSA-2008-0013.html
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=454792
- 28928 vdb-entry
- 20090120 rPSA-2009-0011-1 perl mailing-list
- 30624 third-party-advisory
- 30025 third-party-advisory
- USN-700-2 vendor-advisory
- 30326 third-party-advisory
- MDVSA-2008:100 vendor-advisory
- DSA-1556 vendor-advisory
- http://www.ipcop.org/index.php?name=News&file=article&sid=41
- 31208 third-party-advisory
- ADV-2008-2265 vdb-entry