CVE-2020-10878

HIGH EPSS 91.0%
Published Jun 5, 20206y ago · Modified Jun 17, 20262w ago
8.6 CVSS 3.1
High
Find Similar
Published Jun 5, 2020 6y ago
Last Modified Jun 17, 2026 2w ago

Description

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

CVSS Details

Base Score
8.6
Exploitability
3.9
Impact
4.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity Low
Availability High

Threat Intelligence

EPSS Exploit Probability
91.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-190 Integer Overflow or Wraparound Numeric Error

Affected Products 25

VendorProductVersionRange
perlperl* <5.30.3
fedoraprojectfedora31any
opensuseleap15.1any
netapponcommand_workflow_automation*any
netappsnap_creator_framework*any
oraclecommunications_billing_and_revenue_management12.0.0.2.0any
oraclecommunications_billing_and_revenue_management12.0.0.3.0any
oraclecommunications_diameter_signaling_router*≥8.0.0  –  ≤8.5.0
oraclecommunications_eagle_application_processor*≥16.1.0  –  ≤16.4.0
oraclecommunications_eagle_lnp_application_processor10.1any
oraclecommunications_eagle_lnp_application_processor10.2any
oraclecommunications_eagle_lnp_application_processor46.7any
oraclecommunications_eagle_lnp_application_processor46.8any
oraclecommunications_eagle_lnp_application_processor46.9any
oraclecommunications_lsms*≥13.1  –  ≤13.4
oraclecommunications_offline_mediation_controller12.0.0.3.0any
oraclecommunications_performance_intelligence_center*≥10.3.0.0.0  –  ≤10.3.0.2.1
oraclecommunications_performance_intelligence_center*≥10.4.0.1.0  –  ≤10.4.0.3.1
oraclecommunications_pricing_design_center12.0.0.3.0any
oracleconfiguration_manager12.1.2.0.8any
oracleenterprise_manager_base_platform13.4.0.0any
oraclesd-wan_aware8.2any
oraclesd-wan_aware9.0any
oraclesd-wan_aware9.1any
oracletekelec_platform_distribution*≥7.4.0  –  ≤7.7.1

References 15

  • lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html
    Mailing ListThird Party Advisory
  • github.com https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod
    Third Party Advisory
  • github.com https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3
    PatchThird Party Advisory
  • github.com https://github.com/perl/perl5/commit/0a320d753fe7fca03df259a4dfd8e641e51edaa8
    PatchThird Party Advisory
  • github.com https://github.com/perl/perl5/commit/3295b48defa0f8570114877b063fe546dd348b3c
    PatchThird Party Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/
  • security.gentoo.org https://security.gentoo.org/glsa/202006-03
    Third Party Advisory
  • security.netapp.com https://security.netapp.com/advisory/ntap-20200611-0001/
    Third Party Advisory
  • oracle.com https://www.oracle.com//security-alerts/cpujul2021.html
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpuApr2021.html
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpuapr2022.html
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpujan2021.html
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpujan2022.html
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpuoct2020.html
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpuoct2021.html
    PatchThird Party Advisory

Remediation

  • github.com https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3
    PatchThird Party Advisory
  • github.com https://github.com/perl/perl5/commit/0a320d753fe7fca03df259a4dfd8e641e51edaa8
    PatchThird Party Advisory
  • github.com https://github.com/perl/perl5/commit/3295b48defa0f8570114877b063fe546dd348b3c
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com//security-alerts/cpujul2021.html
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpuApr2021.html
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpuapr2022.html
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpujan2021.html
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpujan2022.html
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpuoct2020.html
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpuoct2021.html
    PatchThird Party Advisory