CVE-2020-10543

high-risk
Published 2020-06-05

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

Do I need to act?

~
4.3% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.2/10 High
NETWORK / LOW complexity

Affected Products (20)

Communications Eagle Application Processor
Communications Eagle Lnp Application Processor
Communications Eagle Lnp Application Processor
Communications Eagle Lnp Application Processor
Communications Eagle Lnp Application Processor
Communications Eagle Lnp Application Processor
Communications Lsms

Affected Vendors

Oracle Perl Fedoraproject Opensuse

References (28)

Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html
Third Party Advisory https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod
Third Party Advisory https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3
Patch https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
Third Party Advisory https://security.gentoo.org/glsa/202006-03
Third Party Advisory https://security.netapp.com/advisory/ntap-20200611-0001/
Patch https://www.oracle.com//security-alerts/cpujul2021.html
Patch https://www.oracle.com/security-alerts/cpuApr2021.html
Patch https://www.oracle.com/security-alerts/cpuapr2022.html
Patch https://www.oracle.com/security-alerts/cpujan2021.html
Patch https://www.oracle.com/security-alerts/cpujan2022.html
Patch https://www.oracle.com/security-alerts/cpuoct2020.html
Patch https://www.oracle.com/security-alerts/cpuoct2021.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html
Third Party Advisory https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod
Third Party Advisory https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3
Patch https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
Third Party Advisory https://security.gentoo.org/glsa/202006-03
and 8 more references
55
/ 100
high-risk
Severity 28/34 · Critical
Exploitability 7/34 · Low
Exposure 20/34 · Moderate