CVE-2020-10878
Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.
- CVSS 3.1
- 8.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H - EPSS
- 4.9% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-25)
- CWE
- CWE-190
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fedoraproject:fedora
- netapp:oncommand_workflow_automation
- netapp:snap_creator_framework
- opensuse:leap
- oracle:communications_billing_and_revenue_management
- oracle:communications_diameter_signaling_router
- oracle:communications_eagle_application_processor
- oracle:communications_eagle_lnp_application_processor
- oracle:communications_lsms
- oracle:communications_offline_mediation_controller
- oracle:communications_performance_intelligence_center
- oracle:communications_pricing_design_center
- oracle:configuration_manager
- oracle:enterprise_manager_base_platform
- oracle:sd-wan_aware
- oracle:tekelec_platform_distribution
- perl:perl
References
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html
- https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod
- https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3
- https://github.com/perl/perl5/commit/0a320d753fe7fca03df259a4dfd8e641e51edaa8
- https://github.com/perl/perl5/commit/3295b48defa0f8570114877b063fe546dd348b3c