Read the docs
TI-2007-04928 Aliases CVE-2007-5116GHSA-3wp4-6pwm-vcxj

Buffer overflow in the polymorphic opcode support in the Regular Expression Engine…

Priority MEDIUM 41CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.

Summary

Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in Perl 5.8 allows context-dependent attackers to execute arbitrary code by switching from byte to Unicode (UTF) characters in a regular expression.

Why it matters now

EPSS 0.0483 92nd percentileScored 2026-11-07
Fix Fixed Red Hat: 3 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 51

CPEVersionsRoleVendor
cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:*3.1Running onDebian
cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*4.0Running onDebian
cpe:2.3:o:debian:debian_linux:4.0:*:alpha:*:*:*:*:*4.0Running onDebian
cpe:2.3:o:debian:debian_linux:4.0:*:amd64:*:*:*:*:*4.0Running onDebian
cpe:2.3:o:debian:debian_linux:4.0:*:arm:*:*:*:*:*4.0Running onDebian
cpe:2.3:o:debian:debian_linux:4.0:*:hppa:*:*:*:*:*4.0Running onDebian
cpe:2.3:o:debian:debian_linux:4.0:*:ia-32:*:*:*:*:*4.0Running onDebian
cpe:2.3:o:debian:debian_linux:4.0:*:ia-64:*:*:*:*:*4.0Running onDebian
cpe:2.3:o:debian:debian_linux:4.0:*:m68k:*:*:*:*:*4.0Running onDebian
cpe:2.3:o:debian:debian_linux:4.0:*:mips:*:*:*:*:*4.0Running onDebian
  • cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:* Versions 3.1 Running on ·Debian
  • cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:* Versions 4.0 Running on ·Debian
  • cpe:2.3:o:debian:debian_linux:4.0:*:alpha:*:*:*:*:* Versions 4.0 Running on ·Debian
  • cpe:2.3:o:debian:debian_linux:4.0:*:amd64:*:*:*:*:* Versions 4.0 Running on ·Debian
  • cpe:2.3:o:debian:debian_linux:4.0:*:arm:*:*:*:*:* Versions 4.0 Running on ·Debian
  • cpe:2.3:o:debian:debian_linux:4.0:*:hppa:*:*:*:*:* Versions 4.0 Running on ·Debian
  • cpe:2.3:o:debian:debian_linux:4.0:*:ia-32:*:*:*:*:* Versions 4.0 Running on ·Debian
  • cpe:2.3:o:debian:debian_linux:4.0:*:ia-64:*:*:*:*:* Versions 4.0 Running on ·Debian
  • cpe:2.3:o:debian:debian_linux:4.0:*:m68k:*:*:*:*:* Versions 4.0 Running on ·Debian
  • cpe:2.3:o:debian:debian_linux:4.0:*:mips:*:*:*:*:* Versions 4.0 Running on ·Debian
Show 41 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:debian:debian_linux:4.0:*:mipsel:*:*:*:*:*4.0Running onDebian
cpe:2.3:o:debian:debian_linux:4.0:*:powerpc:*:*:*:*:*4.0Running onDebian
cpe:2.3:o:debian:debian_linux:4.0:*:s390:*:*:*:*:*4.0Running onDebian
cpe:2.3:o:debian:debian_linux:4.0:*:sparc:*:*:*:*:*4.0Running onDebian
cpe:2.3:o:mandrakesoft:mandrake_linux:2007:*:*:*:*:*:*:*2007Running onMandrakesoft
cpe:2.3:o:mandrakesoft:mandrake_linux:2007:*:x86_64:*:*:*:*:*2007Running onMandrakesoft
cpe:2.3:o:mandrakesoft:mandrake_linux:2007.1:*:*:*:*:*:*:*2007.1Running onMandrakesoft
cpe:2.3:o:mandrakesoft:mandrake_linux:2007.1:*:x86_64:*:*:*:*:*2007.1Running onMandrakesoft
cpe:2.3:o:mandrakesoft:mandrake_linux:2008.0:*:*:*:*:*:*:*2008.0Running onMandrakesoft
cpe:2.3:o:mandrakesoft:mandrake_linux:2008.0:*:x86_64:*:*:*:*:*2008.0Running onMandrakesoft
cpe:2.3:o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*3.0Running onMandrakesoft
cpe:2.3:o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:x86_64:*:*:*:*:*3.0Running onMandrakesoft
cpe:2.3:o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:*:*:*:*:*:*4.0Running onMandrakesoft
cpe:2.3:o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:x86_64:*:*:*:*:*4.0Running onMandrakesoft
cpe:2.3:o:redhat:enterprise_linux:3.0:*:as:*:*:*:*:*3.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:3.0:*:es:*:*:*:*:*3.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:3.0:*:ws:*:*:*:*:*3.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:4.0:*:as:*:*:*:*:*4.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:4.0:*:es:*:*:*:*:*4.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:4.0:*:ws:*:*:*:*:*4.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:5.0:*:client:*:*:*:*:*5.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:5.0:*:server:*:*:*:*:*5.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:3.0:*:*:*:*:*:*:*3.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:4.0:*:*:*:*:*:*:*4.0Running onRed Hat
cpe:2.3:o:redhat:linux_advanced_workstation:2.1:*:ia64:*:*:*:*:*2.1Running onRed Hat
cpe:2.3:o:redhat:linux_advanced_workstation:2.1:*:itanium_processor:*:*:*:*:*2.1Running onRed Hat
cpe:2.3:o:rpath:rpath_linux:1:*:*:*:*:*:*:*1Running onRpath
cpe:2.3:a:larry_wall:perl:5.8.0:*:*:*:*:*:*:*5.8.0VulnerableLarry Wall
cpe:2.3:a:larry_wall:perl:5.8.1:*:*:*:*:*:*:*5.8.1VulnerableLarry Wall
cpe:2.3:a:larry_wall:perl:5.8.3:*:*:*:*:*:*:*5.8.3VulnerableLarry Wall
cpe:2.3:a:larry_wall:perl:5.8.4:*:*:*:*:*:*:*5.8.4VulnerableLarry Wall
cpe:2.3:a:larry_wall:perl:5.8.4.1:*:*:*:*:*:*:*5.8.4.1VulnerableLarry Wall
cpe:2.3:a:larry_wall:perl:5.8.4.2:*:*:*:*:*:*:*5.8.4.2VulnerableLarry Wall
cpe:2.3:a:larry_wall:perl:5.8.4.2.3:*:*:*:*:*:*:*5.8.4.2.3VulnerableLarry Wall
cpe:2.3:a:larry_wall:perl:5.8.4.3:*:*:*:*:*:*:*5.8.4.3VulnerableLarry Wall
cpe:2.3:a:larry_wall:perl:5.8.4.4:*:*:*:*:*:*:*5.8.4.4VulnerableLarry Wall
cpe:2.3:a:larry_wall:perl:5.8.4.5:*:*:*:*:*:*:*5.8.4.5VulnerableLarry Wall
cpe:2.3:a:larry_wall:perl:5.8.6:*:*:*:*:*:*:*5.8.6VulnerableLarry Wall
cpe:2.3:a:mandrakesoft:mandrake_multi_network_firewall:2.0:*:*:*:*:*:*:*2.0VulnerableMandrakesoft
cpe:2.3:a:openpkg:openpkg:current:*:*:*:*:*:*:*currentVulnerableOpenpkg
cpe:2.3:o:redhat:enterprise_linux:1.0:*:application_stack:*:*:*:*:*1.0VulnerableRed Hat
  • cpe:2.3:o:debian:debian_linux:4.0:*:mipsel:*:*:*:*:* Versions 4.0 Running on ·Debian
  • cpe:2.3:o:debian:debian_linux:4.0:*:powerpc:*:*:*:*:* Versions 4.0 Running on ·Debian
  • cpe:2.3:o:debian:debian_linux:4.0:*:s390:*:*:*:*:* Versions 4.0 Running on ·Debian
  • cpe:2.3:o:debian:debian_linux:4.0:*:sparc:*:*:*:*:* Versions 4.0 Running on ·Debian
  • cpe:2.3:o:mandrakesoft:mandrake_linux:2007:*:*:*:*:*:*:* Versions 2007 Running on ·Mandrakesoft
  • cpe:2.3:o:mandrakesoft:mandrake_linux:2007:*:x86_64:*:*:*:*:* Versions 2007 Running on ·Mandrakesoft
  • cpe:2.3:o:mandrakesoft:mandrake_linux:2007.1:*:*:*:*:*:*:* Versions 2007.1 Running on ·Mandrakesoft
  • cpe:2.3:o:mandrakesoft:mandrake_linux:2007.1:*:x86_64:*:*:*:*:* Versions 2007.1 Running on ·Mandrakesoft
  • cpe:2.3:o:mandrakesoft:mandrake_linux:2008.0:*:*:*:*:*:*:* Versions 2008.0 Running on ·Mandrakesoft
  • cpe:2.3:o:mandrakesoft:mandrake_linux:2008.0:*:x86_64:*:*:*:*:* Versions 2008.0 Running on ·Mandrakesoft
  • cpe:2.3:o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:* Versions 3.0 Running on ·Mandrakesoft
  • cpe:2.3:o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:x86_64:*:*:*:*:* Versions 3.0 Running on ·Mandrakesoft
  • cpe:2.3:o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:*:*:*:*:*:* Versions 4.0 Running on ·Mandrakesoft
  • cpe:2.3:o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:x86_64:*:*:*:*:* Versions 4.0 Running on ·Mandrakesoft
  • cpe:2.3:o:redhat:enterprise_linux:3.0:*:as:*:*:*:*:* Versions 3.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:3.0:*:es:*:*:*:*:* Versions 3.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:3.0:*:ws:*:*:*:*:* Versions 3.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:4.0:*:as:*:*:*:*:* Versions 4.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:4.0:*:es:*:*:*:*:* Versions 4.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:4.0:*:ws:*:*:*:*:* Versions 4.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:5.0:*:client:*:*:*:*:* Versions 5.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:5.0:*:server:*:*:*:*:* Versions 5.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:3.0:*:*:*:*:*:*:* Versions 3.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:4.0:*:*:*:*:*:*:* Versions 4.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:linux_advanced_workstation:2.1:*:ia64:*:*:*:*:* Versions 2.1 Running on ·Red Hat
  • cpe:2.3:o:redhat:linux_advanced_workstation:2.1:*:itanium_processor:*:*:*:*:* Versions 2.1 Running on ·Red Hat
  • cpe:2.3:o:rpath:rpath_linux:1:*:*:*:*:*:*:* Versions 1 Running on ·Rpath
  • cpe:2.3:a:larry_wall:perl:5.8.0:*:*:*:*:*:*:* Versions 5.8.0 Vulnerable ·Larry Wall
  • cpe:2.3:a:larry_wall:perl:5.8.1:*:*:*:*:*:*:* Versions 5.8.1 Vulnerable ·Larry Wall
  • cpe:2.3:a:larry_wall:perl:5.8.3:*:*:*:*:*:*:* Versions 5.8.3 Vulnerable ·Larry Wall
  • cpe:2.3:a:larry_wall:perl:5.8.4:*:*:*:*:*:*:* Versions 5.8.4 Vulnerable ·Larry Wall
  • cpe:2.3:a:larry_wall:perl:5.8.4.1:*:*:*:*:*:*:* Versions 5.8.4.1 Vulnerable ·Larry Wall
  • cpe:2.3:a:larry_wall:perl:5.8.4.2:*:*:*:*:*:*:* Versions 5.8.4.2 Vulnerable ·Larry Wall
  • cpe:2.3:a:larry_wall:perl:5.8.4.2.3:*:*:*:*:*:*:* Versions 5.8.4.2.3 Vulnerable ·Larry Wall
  • cpe:2.3:a:larry_wall:perl:5.8.4.3:*:*:*:*:*:*:* Versions 5.8.4.3 Vulnerable ·Larry Wall
  • cpe:2.3:a:larry_wall:perl:5.8.4.4:*:*:*:*:*:*:* Versions 5.8.4.4 Vulnerable ·Larry Wall
  • cpe:2.3:a:larry_wall:perl:5.8.4.5:*:*:*:*:*:*:* Versions 5.8.4.5 Vulnerable ·Larry Wall
  • cpe:2.3:a:larry_wall:perl:5.8.6:*:*:*:*:*:*:* Versions 5.8.6 Vulnerable ·Larry Wall
  • cpe:2.3:a:mandrakesoft:mandrake_multi_network_firewall:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Mandrakesoft
  • cpe:2.3:a:openpkg:openpkg:current:*:*:*:*:*:*:* Versions current Vulnerable ·Openpkg
  • cpe:2.3:o:redhat:enterprise_linux:1.0:*:application_stack:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat

Remediation

Red Hat 3 advisories

  • RHSA-2010:0602 Released 2010-08-04 · Red Hat rating Moderate
    Red Hat Certificate System 7.3 security update
    • Red Hat Certificate System 7.3 for 4AS ant-1.6.5-1jpp_1rh, avalon-logkit-1.2-2jpp_4rh, axis-1.2.1-1jpp_3rh +39
    • Red Hat Certificate System 7.3 for 4ES ant-1.6.5-1jpp_1rh, avalon-logkit-1.2-2jpp_4rh, axis-1.2.1-1jpp_3rh +39
  • RHSA-2007:1011 Released 2007-11-05 · Red Hat rating Important
    perl security update
    • Red Hat Application Stack v1 for Enterprise Linux AS (v.4) perl-4:5.8.8-5.el4s1_2, perl-4:5.8.8-5.el4s1_2.i386, perl-suidperl-4:5.8.8-5.el4s1_2 +1
    • Red Hat Application Stack v1 for Enterprise Linux ES (v.4) perl-4:5.8.8-5.el4s1_2, perl-4:5.8.8-5.el4s1_2.i386, perl-suidperl-4:5.8.8-5.el4s1_2 +1
  • RHSA-2007:0966 Released 2007-11-05 · Red Hat rating Important
    perl security update
    • Red Hat Desktop version 3 perl-2:5.8.0-97.EL3, perl-2:5.8.0-97.EL3.i386, perl-CGI-2:2.89-97.EL3 +7
    • Red Hat Enterprise Linux (v. 5 server) perl-4:5.8.8-10.el5_0.2, perl-4:5.8.8-10.el5_0.2.i386, perl-4:5.8.8-10.el5_0.2.ia64 +5
    • Red Hat Enterprise Linux AS version 3 perl-2:5.8.0-97.EL3, perl-2:5.8.0-97.EL3.i386, perl-2:5.8.0-97.EL3.ia64 +17
    • Red Hat Enterprise Linux AS version 4 perl-3:5.8.5-36.el4_5.2, perl-3:5.8.5-36.el4_5.2.i386, perl-3:5.8.5-36.el4_5.2.ia64 +5
    • Red Hat Enterprise Linux Desktop (v. 5 client) perl-4:5.8.8-10.el5_0.2, perl-4:5.8.8-10.el5_0.2.i386, perl-suidperl-4:5.8.8-10.el5_0.2 +1
    • Red Hat Enterprise Linux Desktop version 4 perl-3:5.8.5-36.el4_5.2, perl-3:5.8.5-36.el4_5.2.i386, perl-suidperl-3:5.8.5-36.el4_5.2 +1
    • Red Hat Enterprise Linux ES version 3 perl-2:5.8.0-97.EL3, perl-2:5.8.0-97.EL3.i386, perl-2:5.8.0-97.EL3.ia64 +12
    • Red Hat Enterprise Linux ES version 4 perl-3:5.8.5-36.el4_5.2, perl-3:5.8.5-36.el4_5.2.i386, perl-3:5.8.5-36.el4_5.2.ia64 +3
    • Red Hat Enterprise Linux WS version 3 perl-2:5.8.0-97.EL3, perl-2:5.8.0-97.EL3.i386, perl-2:5.8.0-97.EL3.ia64 +12
    • Red Hat Enterprise Linux WS version 4 perl-3:5.8.5-36.el4_5.2, perl-3:5.8.5-36.el4_5.2.i386, perl-3:5.8.5-36.el4_5.2.ia64 +3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Application Stack v1 for Enterprise Linux AS (v.4)Fixed RHSA-2007:1011
Red Hat Application Stack v1 for Enterprise Linux ES (v.4)Fixed RHSA-2007:1011
Red Hat Certificate System 7.3 for 4ASFixed RHSA-2010:0602
Red Hat Certificate System 7.3 for 4ESFixed RHSA-2010:0602
Red Hat Desktop version 3Fixed RHSA-2007:0966
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2007:0966
Red Hat Enterprise Linux AS version 3Fixed RHSA-2007:0966
Red Hat Enterprise Linux AS version 4Fixed RHSA-2007:0966
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2007:0966
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2007:0966
Red Hat Enterprise Linux ES version 3Fixed RHSA-2007:0966
Red Hat Enterprise Linux ES version 4Fixed RHSA-2007:0966
Red Hat Enterprise Linux WS version 3Fixed RHSA-2007:0966
Red Hat Enterprise Linux WS version 4Fixed RHSA-2007:0966

Timeline

  1. 2026-10-02 Threatist record created from CVE-2007-5116
  2. 2026-10-03 Alias added: GHSA-3wp4-6pwm-vcxj

References

Patch 1

Advisory 15

Other 14

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences