CVE-2020-10878High· 8.6▾ TwilightPerl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.3 · likelihood 1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
4.9%
Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.
perl < 5.30.3fedora = 31leap = 15.1oncommand_workflow_automationsnap_creator_frameworkcommunications_billing_and_revenue_management = 12.0.0.2.0communications_billing_and_revenue_management = 12.0.0.3.0communications_diameter_signaling_router >= 8.0.0, <= 8.5.0communications_eagle_application_processor >= 16.1.0, <= 16.4.0communications_eagle_lnp_application_processor = 10.1communications_eagle_lnp_application_processor = 10.2communications_eagle_lnp_application_processor = 46.7communications_eagle_lnp_application_processor = 46.8communications_eagle_lnp_application_processor = 46.9communications_lsms >= 13.1, <= 13.4communications_offline_mediation_controller = 12.0.0.3.0communications_performance_intelligence_center >= 10.3.0.0.0, <= 10.3.0.2.1communications_performance_intelligence_center >= 10.4.0.1.0, <= 10.4.0.3.1communications_pricing_design_center = 12.0.0.3.0configuration_manager = 12.1.2.0.8enterprise_manager_base_platform = 13.4.0.0sd-wan_aware = 8.2sd-wan_aware = 9.0sd-wan_aware = 9.1tekelec_platform_distribution >= 7.4.0, <= 7.7.1Upgrade past the affected range:
perl 5.30.3Connected by shared product, vendor, weakness, or advisory.
CVE-2020-10543High· 8.2Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.
CVE-2020-12723High· 7.5regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.
CVE-2020-13434Medium· 5.5SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.
CVE-2020-10531High· 8.8An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1
CVE-2019-5435Low· 3.7An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.
CVE-2019-1551Medium· 5.3There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli