{"id":"CVE-2023-47038","summary":"Perl: write past buffer end via illegal user-defined unicode property","details":"A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.","modified":"2026-08-12T14:51:27.262068Z","published":"2023-12-18T13:43:07.713Z","related":["ALSA-2024:2228","ALSA-2024:3128","openSUSE-SU-2024:13479-1"],"database_specific":{"cna_assigner":"redhat","cwe_ids":["CWE-122"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47038.json"},"references":[{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"WEB","url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1056746"},{"type":"WEB","url":"https://github.com/aquasecurity/trivy/discussions/8400"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GNEEWAACXQCEEAKSG7XX2D5YDRWLCIZJ/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UMDZZ4SCEW6FRWZDMXGAKZ35THTAWFG6/"},{"type":"WEB","url":"https://perldoc.perl.org/perl5382delta#CVE-2023-47038-Write-past-buffer-end-via-illegal-user-defined-Unicode-property"},{"type":"WEB","url":"https://ubuntu.com/security/CVE-2023-47100"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-47100.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:2228"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:3128"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2023-47038"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47038.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-47038"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2249523"},{"type":"FIX","url":"https://github.com/Perl/perl5/commit/12c313ce49b36160a7ca2e9b07ad5bd92ee4a010"},{"type":"FIX","url":"https://github.com/Perl/perl5/commit/7047915eef37fccd93e7cd985c29fe6be54650b6"},{"type":"FIX","url":"https://github.com/Perl/perl5/commit/ff1f9f59360afeebd6f75ca1502f5c3ebf077da3"},{"type":"PACKAGE","url":"https://github.com/Perl/perl5"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/perl/perl5","events":[{"introduced":"44523d1ffde5f23de2e13216cdbac46357631904"},{"fixed":"12c313ce49b36160a7ca2e9b07ad5bd92ee4a010"},{"fixed":"7047915eef37fccd93e7cd985c29fe6be54650b6"},{"fixed":"ff1f9f59360afeebd6f75ca1502f5c3ebf077da3"}],"database_specific":{"extracted_events":[{"introduced":"5.30.0"},{"last_affected":"5.38.0"}],"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*"}}],"versions":["v5.39.5","v5.39.4","v5.38.0","v5.39.3","v5.39.1","v5.39.0","v5.38.0-RC2","v5.38.0-RC1","v5.36.1","v5.37.11","v5.36.1-RC3","v5.36.1-RC2","v5.36.1-RC1","v5.37.10","v5.37.9","v5.37.7","v5.37.6","v5.37.5","v5.37.4","v5.37.3","v5.37.2","v5.37.1","v5.36.0","v5.37.0","v5.36.0-RC3","v5.35.11","v5.35.10","v5.34.1","v5.34.1-RC2","v5.34.1-RC1","v5.34.0","v5.35.9","v5.35.8","v5.35.6","v5.35.5","v5.35.3","v5.35.0","v5.34.0-RC2","v5.34.0-RC1","v5.33.9","v5.33.8","v5.33.7","v5.32.0","v5.33.4","v5.33.3","v5.33.2","v5.33.1","v5.33.0","v5.32.0-RC1","v5.31.11","v5.31.7","v5.31.5","v5.30.0","v5.31.4","v5.31.3","v5.31.2","v5.31.1","v5.31.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-47038.json","vanir_signatures_modified":"2026-08-12T14:51:27Z","vanir_signatures":[{"id":"CVE-2023-47038-25a411b3","signature_type":"Line","signature_version":"v1","source":"https://github.com/perl/perl5/commit/ff1f9f59360afeebd6f75ca1502f5c3ebf077da3","target":{"file":"regcomp.c"},"deprecated":false,"digest":{"line_hashes":["293151830564086057975937478145914932521","143453480806131793255850162682972791677","49908078177243315762977250841678391040","42104507940110116460481038906207795532","292801548212068716341663467870433321819","212097729157823892197038680263482191794","144636467486871689450262130624485683886","335528991668785098518339371645954218045","299294200457540300074871374773975371398","167558216281262761149252772934203375680","228324759900382015466878919495742988297","74020277280142741159892597680004234788","113932126825401564749306971437333044127","247111147840606110998218129682026188629","138101284308869327359391341269680722528","8701125679094550235987128839545290268","115265112681309483517465494462799681859","84378174528897378644201700403584698336"],"threshold":0.9}},{"id":"CVE-2023-47038-693fbd38","signature_type":"Line","signature_version":"v1","source":"https://github.com/perl/perl5/commit/12c313ce49b36160a7ca2e9b07ad5bd92ee4a010","target":{"file":"regcomp.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["293151830564086057975937478145914932521","143453480806131793255850162682972791677","49908078177243315762977250841678391040","42104507940110116460481038906207795532","335342254380232159137657033313261520238","142206445844056675113002677752098323015","144636467486871689450262130624485683886","335528991668785098518339371645954218045","299294200457540300074871374773975371398","167558216281262761149252772934203375680","228324759900382015466878919495742988297","74020277280142741159892597680004234788","113932126825401564749306971437333044127","247111147840606110998218129682026188629","138101284308869327359391341269680722528","8701125679094550235987128839545290268","115265112681309483517465494462799681859","84378174528897378644201700403584698336"]}},{"deprecated":false,"digest":{"line_hashes":["293151830564086057975937478145914932521","143453480806131793255850162682972791677","49908078177243315762977250841678391040","42104507940110116460481038906207795532","335342254380232159137657033313261520238","142206445844056675113002677752098323015","144636467486871689450262130624485683886","335528991668785098518339371645954218045","299294200457540300074871374773975371398","167558216281262761149252772934203375680","228324759900382015466878919495742988297","74020277280142741159892597680004234788","113932126825401564749306971437333044127","247111147840606110998218129682026188629","138101284308869327359391341269680722528","8701125679094550235987128839545290268","115265112681309483517465494462799681859","84378174528897378644201700403584698336"],"threshold":0.9},"id":"CVE-2023-47038-e5f4bbb5","signature_type":"Line","signature_version":"v1","source":"https://github.com/perl/perl5/commit/7047915eef37fccd93e7cd985c29fe6be54650b6","target":{"file":"regcomp.c"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}