List
Monthly
Heap buffer overflow in the Perl module List::SomeUtils::XS before 0.59 lets a program corrupt heap memory whenever its pairwise() block returns, for a single input pair, more than four times the longer input array's length. The C-level pairwise() implementation grows its result buffer with a single quadrupling (alloc <<= 2) rather than a loop, so an oversized single-call return outruns the allocation and the copy writes past the buffer end. No public exploit identified at time of analysis; EPSS is low (0.42%) and SSVC records no observed exploitation, but a vendor patch (0.59) is available and the trigger is trivially demonstrable.
Heap buffer overflow in the Perl module List::SomeUtils::XS before 0.59 lets a program corrupt heap memory whenever its pairwise() block returns, for a single input pair, more than four times the longer input array's length. The C-level pairwise() implementation grows its result buffer with a single quadrupling (alloc <<= 2) rather than a loop, so an oversized single-call return outruns the allocation and the copy writes past the buffer end. No public exploit identified at time of analysis; EPSS is low (0.42%) and SSVC records no observed exploitation, but a vendor patch (0.59) is available and the trigger is trivially demonstrable.