CVE-2010-1158: Integer Overflow
Bruce Merry reported: [1] http://bugs.gentoo.org/showbug.cgi?id=313565
an integer overflow, leading to stack overflow in the way Perl regular expression engine processed certain regular expression(s). Remote attacker could use this flaw to cause a denial of service (crash of an application, using the Perl regular expression engine).
Public PoC from [1]: -------------------- perl -e 'if ((("a " x 100000) . "a\n") =~ /\A\S+(?: \S+)\n\z/) {}'
Other sources
Integer overflow in the regular expression engine in Perl 5.8.x allows context-dependent attackers to cause a denial of service (stack consumption and application crash) by matching a crafted regular expression against a long string.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-1158?
The severity of CVE-2010-1158 is classified as high due to the potential for remote code execution.
How do I fix CVE-2010-1158?
To fix CVE-2010-1158, update Perl to a version later than 5.8.9, which addresses the integer overflow issue.
What versions of Perl are affected by CVE-2010-1158?
CVE-2010-1158 affects Perl versions 5.8.1 through 5.8.9.
Can CVE-2010-1158 lead to a system compromise?
Yes, CVE-2010-1158 can allow a remote attacker to execute arbitrary code, potentially leading to a system compromise.
Is CVE-2010-1158 a local or remote vulnerability?
CVE-2010-1158 is a remote vulnerability that can be exploited by attackers over the network.