--- id: CVE-2020-10543 title: >- Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow. summary: >- Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow. severity: high cvss: 8.2 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H' cwe: - CWE-190 - CWE-787 vendor: perl product: perl affected: - perl < 5.30.3 - fedora = 31 - leap = 15.1 - communications_billing_and_revenue_management = 12.0.0.2.0 - communications_billing_and_revenue_management = 12.0.0.3.0 - 'communications_diameter_signaling_router >= 8.0.0, <= 8.5.0' - 'communications_eagle_application_processor >= 16.1.0, <= 16.4.0' - communications_eagle_lnp_application_processor = 10.1 - communications_eagle_lnp_application_processor = 10.2 - communications_eagle_lnp_application_processor = 46.7 - communications_eagle_lnp_application_processor = 46.8 - communications_eagle_lnp_application_processor = 46.9 - 'communications_lsms >= 13.1, <= 13.4' - communications_offline_mediation_controller = 12.0.0.3.0 - 'communications_performance_intelligence_center >= 10.3.0.0.0, <= 10.3.0.2.1' - 'communications_performance_intelligence_center >= 10.4.0.1.0, <= 10.4.0.3.1' - communications_pricing_design_center = 12.0.0.3.0 - configuration_manager = 12.1.2.0.8 - enterprise_manager_base_platform = 13.4.0.0 - sd-wan_edge = 8.2 - sd-wan_edge = 9.0 - sd-wan_edge = 9.1 - 'tekelec_platform_distribution >= 7.4.0, <= 7.7.1' patched: - perl 5.30.3 published: '2020-06-05' updated: '2026-10-14' sourceUpdated: '2026-10-14T09:17:17.043' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-10543' references: - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html' label: cve@mitre.org - url: 'https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod' label: cve@mitre.org - url: 'https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3' label: cve@mitre.org - url: >- https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/ label: cve@mitre.org - url: 'https://security.gentoo.org/glsa/202006-03' label: cve@mitre.org - url: 'https://security.netapp.com/advisory/ntap-20200611-0001/' label: cve@mitre.org - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuApr2021.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpujan2021.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpujan2022.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuoct2020.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: cve@mitre.org - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.gentoo.org/glsa/202006-03' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20200611-0001/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuApr2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuoct2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e tags: - nvd epss: 0.11334 epssPercentile: 0.95904 ingestedAt: '2026-10-14T09:24:26.056Z' --- ## Overview Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow. ## Affected - `perl < 5.30.3` - `fedora = 31` - `leap = 15.1` - `communications_billing_and_revenue_management = 12.0.0.2.0` - `communications_billing_and_revenue_management = 12.0.0.3.0` - `communications_diameter_signaling_router >= 8.0.0, <= 8.5.0` - `communications_eagle_application_processor >= 16.1.0, <= 16.4.0` - `communications_eagle_lnp_application_processor = 10.1` - `communications_eagle_lnp_application_processor = 10.2` - `communications_eagle_lnp_application_processor = 46.7` - `communications_eagle_lnp_application_processor = 46.8` - `communications_eagle_lnp_application_processor = 46.9` - `communications_lsms >= 13.1, <= 13.4` - `communications_offline_mediation_controller = 12.0.0.3.0` - `communications_performance_intelligence_center >= 10.3.0.0.0, <= 10.3.0.2.1` - `communications_performance_intelligence_center >= 10.4.0.1.0, <= 10.4.0.3.1` - `communications_pricing_design_center = 12.0.0.3.0` - `configuration_manager = 12.1.2.0.8` - `enterprise_manager_base_platform = 13.4.0.0` - `sd-wan_edge = 8.2` - `sd-wan_edge = 9.0` - `sd-wan_edge = 9.1` - `tekelec_platform_distribution >= 7.4.0, <= 7.7.1` ## Remediation Upgrade past the affected range: - `perl 5.30.3`