CVE-2010-4777: Input Validation
It was reported [1] that perl suffers from an assertion failure in certain regular expressions. This could cause crashes in certain programs, such as OCSInventory [2] and SpamAssassin [3].
[1] http://rt.perl.org/rt3/Public/Bug/Display.html?id=76538 [2] http://forums.ocsinventory-ng.org/viewtopic.php?id=7215 [3] https://listi.jpberlin.de/pipermail/postfixbuch-users/2011-February/055885.html
Other sources
The Perlregnumberedbufffetch function in Perl 5.10.0, 5.12.0, 5.14.0, and other versions, when running with debugging enabled, allows context-dependent attackers to cause a denial of service (assertion failure and application exit) via crafted input that is not properly handled when using certain regular expressions, as demonstrated by causing SpamAssassin and OCSInventory to crash.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4777?
CVE-2010-4777 is considered to have a moderate severity as it can lead to application crashes.
How do I fix CVE-2010-4777?
To mitigate CVE-2010-4777, consider upgrading to a version of Perl that is not affected, such as any version later than 5.14.0.
Which versions of Perl are affected by CVE-2010-4777?
CVE-2010-4777 affects Perl versions 5.10, 5.12.0, and 5.14.0.
What type of applications are impacted by CVE-2010-4777?
Applications that utilize specific regular expressions in Perl, like OCSInventory and SpamAssassin, are impacted by CVE-2010-4777.
Is CVE-2010-4777 a known bug?
Yes, CVE-2010-4777 has been reported as a bug due to an assertion failure in certain regular expressions.