CVE-2020-12723

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.
Classic Buffer Overflow
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 39%
VendorProductVersion
perlperl
𝑥
< 5.30.3
netapponcommand_workflow_automation
-
netappsnap_creator_framework
-
opensuseleap
15.1
oraclecommunications_billing_and_revenue_management
12.0.0.2.0
oraclecommunications_billing_and_revenue_management
12.0.0.3.0
oraclecommunications_diameter_signaling_router
8.0.0 ≤
𝑥
≤ 8.5.0
oraclecommunications_eagle_application_processor
16.1.0 ≤
𝑥
≤ 16.4.0
oraclecommunications_eagle_lnp_application_processor
10.1
oraclecommunications_eagle_lnp_application_processor
10.2
oraclecommunications_lsms
13.1 ≤
𝑥
≤ 13.4
oraclecommunications_offline_mediation_controller
12.0.0.3.0
oraclecommunications_performance_intelligence_center
10.3.0.0.0 ≤
𝑥
≤ 10.3.0.2.1
oraclecommunications_performance_intelligence_center
10.4.0.1.0 ≤
𝑥
≤ 10.4.0.3.1
oracleconfiguration_manager
12.1.2.0.8
oracleenterprise_manager_base_platform
13.4.0.0
oraclesd-wan_edge
8.2
oraclesd-wan_edge
9.0
oraclesd-wan_edge
9.1
oracletekelec_platform_distribution
7.4.0 ≤
𝑥
≤ 7.7.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
perl
bullseye
5.32.1-4+deb11u3
fixed
bullseye (security)
5.32.1-4+deb11u4
fixed
bookworm
5.36.0-7+deb12u1
fixed
sid
5.40.0-6
fixed
trixie
5.40.0-6
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
perl
groovy
not-affected
focal
Fixed 5.30.0-9ubuntu0.2
released
eoan
ignored
bionic
Fixed 5.26.1-6ubuntu0.5
released
xenial
Fixed 5.22.1-9ubuntu0.9
released
trusty
Fixed 5.18.2-2ubuntu1.7+esm3
released
References