CVE-2020-12723

Description

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

CVSS breakdown

Affected products

• fedoraproject / fedora31 – 31
• NetApp / OnCommand Workflow Automation
• NetApp / snap_creator_framework
• openSUSE / Leap15.1 – 15.1
• oracle / communications_billing_and_revenue_management12.0.0.3.0 – 12.0.0.3.0
• oracle / communications_billing_and_revenue_management12.0.0.2.0 – 12.0.0.2.0
• oracle / communications_diameter_signaling_router8.0.0 – 8.5.0
• oracle / communications_eagle_application_processor16.1.0 – 16.4.0
• oracle / communications_eagle_lnp_application_processor10.2 – 10.2
• oracle / communications_eagle_lnp_application_processor10.1 – 10.1
• oracle / communications_lsms13.1 – 13.4
• oracle / communications_offline_mediation_controller12.0.0.3.0 – 12.0.0.3.0
• oracle / communications_performance_intelligence_center10.3.0.0.0 – 10.3.0.2.1
• oracle / configuration_manager12.1.2.0.8 – 12.1.2.0.8
• oracle / enterprise_manager_base_platform13.4.0.0 – 13.4.0.0
• oracle / sd-wan_edge9.0 – 9.0
• oracle / sd-wan_edge8.2 – 8.2
• oracle / sd-wan_edge9.1 – 9.1
• oracle / tekelec_platform_distribution7.4.0 – 7.7.1
• perl / perl5.30.3

References

• MISChttps://security.gentoo.org/glsa/202006-03
• MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/
• MAILING_LISThttp://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2020.html
• MISChttps://github.com/Perl/perl5/compare/v5.30.2...v5.30.3
• MISChttps://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod
• MISChttps://security.netapp.com/advisory/ntap-20200611-0001/
• MISChttps://github.com/Perl/perl5/issues/16947
• MISChttps://github.com/Perl/perl5/issues/17743
• PATCHhttps://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujan2021.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuApr2021.html
• VENDOR_ADVISORYhttps://www.oracle.com//security-alerts/cpujul2021.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2021.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujan2022.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuapr2022.html