CVE-2020-10543
Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.
- CVSS 3.1
- 8.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - EPSS
- 11% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-25)
- CWEs
- CWE-190, CWE-787
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fedoraproject:fedora
- opensuse:leap
- oracle:communications_billing_and_revenue_management
- oracle:communications_diameter_signaling_router
- oracle:communications_eagle_application_processor
- oracle:communications_eagle_lnp_application_processor
- oracle:communications_lsms
- oracle:communications_offline_mediation_controller
- oracle:communications_performance_intelligence_center
- oracle:communications_pricing_design_center
- oracle:configuration_manager
- oracle:enterprise_manager_base_platform
- oracle:sd-wan_edge
- oracle:tekelec_platform_distribution
- perl:perl
References
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html
- https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod
- https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3
- https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/