{"id":"CVE-2020-10878","title":"Perl before 5.30.3 has an integer overflow related to mishandling of a \"PL_regkind[OP(n)] == NOTHING\" situation","summary":"Perl before 5.30.3 has an integer overflow related to mishandling of a \"PL_regkind[OP(n)] == NOTHING\" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","cwe":["CWE-190"],"vendor":"perl","product":"perl","affected":["perl < 5.30.3","fedora = 31","leap = 15.1","oncommand_workflow_automation","snap_creator_framework","communications_billing_and_revenue_management = 12.0.0.2.0","communications_billing_and_revenue_management = 12.0.0.3.0","communications_diameter_signaling_router >= 8.0.0, <= 8.5.0","communications_eagle_application_processor >= 16.1.0, <= 16.4.0","communications_eagle_lnp_application_processor = 10.1","communications_eagle_lnp_application_processor = 10.2","communications_eagle_lnp_application_processor = 46.7","communications_eagle_lnp_application_processor = 46.8","communications_eagle_lnp_application_processor = 46.9","communications_lsms >= 13.1, <= 13.4","communications_offline_mediation_controller = 12.0.0.3.0","communications_performance_intelligence_center >= 10.3.0.0.0, <= 10.3.0.2.1","communications_performance_intelligence_center >= 10.4.0.1.0, <= 10.4.0.3.1","communications_pricing_design_center = 12.0.0.3.0","configuration_manager = 12.1.2.0.8","enterprise_manager_base_platform = 13.4.0.0","sd-wan_aware = 8.2","sd-wan_aware = 9.0","sd-wan_aware = 9.1","tekelec_platform_distribution >= 7.4.0, <= 7.7.1"],"patched":["perl 5.30.3"],"published":"2020-06-05","updated":"2026-10-14","sourceUpdated":"2026-10-14T09:17:17.657","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2020-10878","references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","label":"cve@mitre.org"},{"url":"https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","label":"cve@mitre.org"},{"url":"https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","label":"cve@mitre.org"},{"url":"https://github.com/perl/perl5/commit/0a320d753fe7fca03df259a4dfd8e641e51edaa8","label":"cve@mitre.org"},{"url":"https://github.com/perl/perl5/commit/3295b48defa0f8570114877b063fe546dd348b3c","label":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","label":"cve@mitre.org"},{"url":"https://security.gentoo.org/glsa/202006-03","label":"cve@mitre.org"},{"url":"https://security.netapp.com/advisory/ntap-20200611-0001/","label":"cve@mitre.org"},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","label":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/perl/perl5/commit/0a320d753fe7fca03df259a4dfd8e641e51edaa8","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/perl/perl5/commit/3295b48defa0f8570114877b063fe546dd348b3c","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202006-03","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20200611-0001/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd"],"epss":0.04879,"epssPercentile":0.91878,"ingestedAt":"2026-10-14T09:24:26.056Z","slug":"CVE-2020-10878","body":"## Overview\n\nPerl before 5.30.3 has an integer overflow related to mishandling of a \"PL_regkind[OP(n)] == NOTHING\" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.\n\n## Affected\n\n- `perl < 5.30.3`\n- `fedora = 31`\n- `leap = 15.1`\n- `oncommand_workflow_automation`\n- `snap_creator_framework`\n- `communications_billing_and_revenue_management = 12.0.0.2.0`\n- `communications_billing_and_revenue_management = 12.0.0.3.0`\n- `communications_diameter_signaling_router >= 8.0.0, <= 8.5.0`\n- `communications_eagle_application_processor >= 16.1.0, <= 16.4.0`\n- `communications_eagle_lnp_application_processor = 10.1`\n- `communications_eagle_lnp_application_processor = 10.2`\n- `communications_eagle_lnp_application_processor = 46.7`\n- `communications_eagle_lnp_application_processor = 46.8`\n- `communications_eagle_lnp_application_processor = 46.9`\n- `communications_lsms >= 13.1, <= 13.4`\n- `communications_offline_mediation_controller = 12.0.0.3.0`\n- `communications_performance_intelligence_center >= 10.3.0.0.0, <= 10.3.0.2.1`\n- `communications_performance_intelligence_center >= 10.4.0.1.0, <= 10.4.0.3.1`\n- `communications_pricing_design_center = 12.0.0.3.0`\n- `configuration_manager = 12.1.2.0.8`\n- `enterprise_manager_base_platform = 13.4.0.0`\n- `sd-wan_aware = 8.2`\n- `sd-wan_aware = 9.0`\n- `sd-wan_aware = 9.1`\n- `tekelec_platform_distribution >= 7.4.0, <= 7.7.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `perl 5.30.3`","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":47.3,"likelihood":1,"exploitation":0,"ransomware":0},"changes":[]}