CVE-2020-10543CWE-190CWE-787

CVE-2020-10543

High · published June 5, 2020

CVSS v3.1
8.2
EPSS
11%
Percentile
96.0
In the wild
Unconfirmed
What it is

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.11334 · 96.0th percentile
Weaknesses
CWE-190 · Integer Overflow or Wraparound; CWE-787 · Out-of-bounds Write
Published
2020-06-05T18:15Z
Affected products (23)
ProductVersionsFixed in
perl/perl< 5.30.35.30.3
fedoraproject/fedoraall versions—
opensuse/leapall versions—
oracle/communications_billing_and_revenue_managementall versions—
oracle/communications_billing_and_revenue_managementall versions—
oracle/communications_diameter_signaling_router≥ 8.0.0, ≤ 8.5.0—
oracle/communications_eagle_application_processor≥ 16.1.0, ≤ 16.4.0—
oracle/communications_eagle_lnp_application_processorall versions—
oracle/communications_eagle_lnp_application_processorall versions—
oracle/communications_eagle_lnp_application_processorall versions—
oracle/communications_eagle_lnp_application_processorall versions—
oracle/communications_eagle_lnp_application_processorall versions—
oracle/communications_lsms≥ 13.1, ≤ 13.4—
oracle/communications_offline_mediation_controllerall versions—
oracle/communications_performance_intelligence_center≥ 10.3.0.0.0, ≤ 10.3.0.2.1—
oracle/communications_performance_intelligence_center≥ 10.4.0.1.0, ≤ 10.4.0.3.1—
oracle/communications_pricing_design_centerall versions—
oracle/configuration_managerall versions—
oracle/enterprise_manager_base_platformall versions—
oracle/sd-wan_edgeall versions—
oracle/sd-wan_edgeall versions—
oracle/sd-wan_edgeall versions—
oracle/tekelec_platform_distribution≥ 7.4.0, ≤ 7.7.1—
References (29)
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html · [email protected]https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod · [email protected]https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3 · [email protected]https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/ · [email protected]https://security.gentoo.org/glsa/202006-03 · [email protected]https://security.netapp.com/advisory/ntap-20200611-0001/ · [email protected]https://www.oracle.com//security-alerts/cpujul2021.html · [email protected]https://www.oracle.com/security-alerts/cpuApr2021.html · [email protected]https://www.oracle.com/security-alerts/cpuapr2022.html · [email protected]https://www.oracle.com/security-alerts/cpujan2021.html · [email protected]https://www.oracle.com/security-alerts/cpujan2022.html · [email protected]https://www.oracle.com/security-alerts/cpuoct2020.html · [email protected]https://www.oracle.com/security-alerts/cpuoct2021.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html · af854a3a-2127-422b-91ae-364da2661108https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod · af854a3a-2127-422b-91ae-364da2661108https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3 · af854a3a-2127-422b-91ae-364da2661108https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/ · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202006-03 · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20200611-0001/ · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com//security-alerts/cpujul2021.html · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuApr2021.html · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2022.html · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujan2021.html · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujan2022.html · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuoct2020.html · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuoct2021.html · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 05 JUN 13:17Z
    Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow
    cvelistv5