critical
9.8
CWE
190
Advisory Published
Updated

CVE-2020-10878: Integer Overflow

First published: Fri Jun 05 2020(Updated: )

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

Credit: Hugo van der Sanden Slaven Rezic cve@mitre.org

Affected SoftwareAffected VersionHow to fix
Apple macOS Catalina<10.15.6
10.15.6
Apple Mojave
Apple High Sierra
Perl Perl<5.30.3
Fedoraproject Fedora=31
openSUSE Leap=15.1
NetApp OnCommand Workflow Automation
NetApp Snap Creator Framework
Oracle Communications Billing and Revenue Management=12.0.0.2.0
Oracle Communications Billing and Revenue Management=12.0.0.3.0
Oracle Communications Diameter Signaling Router>=8.0.0<=8.5.0
Oracle Communications EAGLE Application Processor>=16.1.0<=16.4.0
Oracle Communications Eagle Lnp Application Processor=10.1
Oracle Communications Eagle Lnp Application Processor=10.2
Oracle Communications Eagle Lnp Application Processor=46.7
Oracle Communications Eagle Lnp Application Processor=46.8
Oracle Communications Eagle Lnp Application Processor=46.9
Oracle Communications Lsms>=13.1<=13.4
Oracle Communications Offline Mediation Controller=12.0.0.3.0
Oracle Communications Performance Intelligence Center>=10.3.0.0.0<=10.3.0.2.1
Oracle Communications Performance Intelligence Center>=10.4.0.1.0<=10.4.0.3.1
Oracle Communications Pricing Design Center=12.0.0.3.0
Oracle Configuration Manager=12.1.2.0.8
Oracle Enterprise Manager Base Platform=13.4.0.0
Oracle SD-WAN Aware=8.2
Oracle SD-WAN Aware=9.0
Oracle SD-WAN Aware=9.1
Oracle Tekelec Platform Distribution>=7.4.0<=7.7.1
IBM Cloud Pak for Security (CP4S)<=1.6.0.1
IBM Cloud Pak for Security (CP4S)<=1.6.0.0
IBM Cloud Pak for Security (CP4S)<=1.5.0.1
IBM Cloud Pak for Security (CP4S)<=1.5.0.0
IBM Cloud Pak for Security (CP4S)<=1.4.0.0

Remedy

https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3

Remedy

https://github.com/perl/perl5/commit/0a320d753fe7fca03df259a4dfd8e641e51edaa8

Remedy

https://github.com/perl/perl5/commit/3295b48defa0f8570114877b063fe546dd348b3c

Remedy

https://www.oracle.com//security-alerts/cpujul2021.html

Remedy

https://www.oracle.com/security-alerts/cpuApr2021.html

Remedy

https://www.oracle.com/security-alerts/cpuapr2022.html

Remedy

https://www.oracle.com/security-alerts/cpujan2021.html

Remedy

https://www.oracle.com/security-alerts/cpujan2022.html

Remedy

https://www.oracle.com/security-alerts/cpuoct2020.html

Remedy

https://www.oracle.com/security-alerts/cpuoct2021.html

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Peer vulnerabilities

(Found alongside the following vulnerabilities)

Frequently Asked Questions

  • What is CVE-2020-10878?

    CVE-2020-10878 is a vulnerability in Perl that has been addressed with improved checks.

  • Which software versions are affected by CVE-2020-10878?

    macOS Catalina version 10.15.6, Apple Mojave, and Apple High Sierra are affected by CVE-2020-10878.

  • How can I fix CVE-2020-10878?

    Update to macOS Catalina version 10.15.6 or apply the necessary patches provided by Apple to fix CVE-2020-10878.

  • Where can I find more information about CVE-2020-10878?

    You can find more information about CVE-2020-10878 on the official Apple support website at: https://support.apple.com/en-us/HT211289

  • What is the Common Weakness Enumeration (CWE) ID associated with CVE-2020-10878?

    The CWE ID associated with CVE-2020-10878 is CWE-190.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203