CVE-2022-48522 In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.
CriticalCVSS 9.8
EPSS 3.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/perl(Debian:12) | < 5.36.0-4 | 5.36.0-4 |
| debian/perl(Debian:13) | < 5.36.0-4 | 5.36.0-4 |
| debian/perl(Debian:14) | < 5.36.0-4 | 5.36.0-4 |
| Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | >= V3.1.0, < V3.1.5 | V3.1.5 |
| Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | >= V3.1.0, < V3.1.5 | V3.1.5 |
| Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP | >= V3.1.0, < V3.1.5 | V3.1.5 |
| ubuntu/perl(Ubuntu:22.04) | < 5.34.0-3ubuntu1.3 | 5.34.0-3ubuntu1.3 |
| perl | = 5.34.0 | No fix listed |
References
- Debian Security Tracker CVE-2022-48522 vendor-advisory
- github.com exploit
- security.netapp.com
- cert-portal.siemens.com
- Ubuntu CVE tracker vendor-advisory
- USN-6517-1 vendor-advisory
- www.cve.org