CVE-2020-10878

Description

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

CVSS breakdown

Affected products

• fedoraproject / fedora31 – 31
• NetApp / OnCommand Workflow Automation
• NetApp / snap_creator_framework
• openSUSE / Leap15.1 – 15.1
• oracle / communications_billing_and_revenue_management12.0.0.3.0 – 12.0.0.3.0
• oracle / communications_billing_and_revenue_management12.0.0.2.0 – 12.0.0.2.0
• oracle / communications_diameter_signaling_router8.0.0 – 8.5.0
• oracle / communications_eagle_application_processor16.1.0 – 16.4.0
• oracle / communications_eagle_lnp_application_processor46.8 – 46.8
• oracle / communications_eagle_lnp_application_processor10.1 – 10.1
• oracle / communications_eagle_lnp_application_processor10.2 – 10.2
• oracle / communications_eagle_lnp_application_processor46.7 – 46.7
• oracle / communications_eagle_lnp_application_processor46.9 – 46.9
• oracle / communications_lsms13.1 – 13.4
• oracle / communications_offline_mediation_controller12.0.0.3.0 – 12.0.0.3.0
• oracle / communications_performance_intelligence_center10.3.0.0.0 – 10.3.0.2.1
• oracle / communications_pricing_design_center12.0.0.3.0 – 12.0.0.3.0
• oracle / configuration_manager12.1.2.0.8 – 12.1.2.0.8
• oracle / enterprise_manager_base_platform13.4.0.0 – 13.4.0.0
• oracle / sd-wan_aware9.0 – 9.0
• oracle / sd-wan_aware8.2 – 8.2
• oracle / sd-wan_aware9.1 – 9.1
• oracle / tekelec_platform_distribution7.4.0 – 7.7.1
• perl / perl5.30.3

References

• MISChttps://security.gentoo.org/glsa/202006-03
• MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/
• MAILING_LISThttp://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2020.html
• MISChttps://github.com/Perl/perl5/compare/v5.30.2...v5.30.3
• MISChttps://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod
• MISChttps://security.netapp.com/advisory/ntap-20200611-0001/
• PATCHhttps://github.com/perl/perl5/commit/0a320d753fe7fca03df259a4dfd8e641e51edaa8
• PATCHhttps://github.com/perl/perl5/commit/3295b48defa0f8570114877b063fe546dd348b3c
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujan2021.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuApr2021.html
• VENDOR_ADVISORYhttps://www.oracle.com//security-alerts/cpujul2021.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2021.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujan2022.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuapr2022.html