http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10543 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10543 Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow. Perl before 5.30.3 has an integer overflow related to mishandling of a 'PL_regkind[OP(n)] == NOTHING' situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection. regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

The remote NewStart CGSL host, running version MAIN 6.02, has perl packages installed that are affected by multiple vulnerabilities:

  - Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular     expression quantifiers have an integer overflow. (CVE-2020-10543)

  - Perl before 5.30.3 has an integer overflow related to mishandling of a PL_regkind[OP(n)] == NOTHING     situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction     injection. (CVE-2020-10878)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the perl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Perl might allow context-dependent attackers to bypass     the taint protection mechanism in a child process via     duplicate environment variables in envp.(CVE-2016-2381)

  - Perl before 5.30.3 on 32-bit platforms allows a     heap-based buffer overflow because nested regular     expression quantifiers have an integer     overflow.(CVE-2020-10543)

  - Perl before 5.30.3 has an integer overflow related to     mishandling of a 'PL_regkind[OP(n)] == NOTHING'     situation. A crafted regular expression could lead to     malformed bytecode with a possibility of instruction     injection.(CVE-2020-10878)

  - regcomp.c in Perl before 5.30.3 allows a buffer     overflow via a crafted regular expression because of     recursive S_study_chunk calls.(CVE-2020-12723)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of perl installed on the remote host is prior to 5.16.3-299. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1610 advisory.

    Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular     expression quantifiers have an integer overflow. (CVE-2020-10543)

    Perl before 5.30.3 has an integer overflow related to mishandling of a PL_regkind[OP(n)] == NOTHING     situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction     injection. (CVE-2020-10878)

    regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of     recursive S_study_chunk calls. (CVE-2020-12723)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Perl before 5.30.3 has an integer overflow related to     mishandling of a 'PL_regkind[OP(n)] == NOTHING'     situation. A crafted regular expression could lead to     malformed bytecode with a possibility of instruction     injection.(CVE-2020-10878)

  - Perl before 5.30.3 on 33-bit platforms allows a     heap-based buffer overflow because nested regular     expression quantifiers have an integer     overflow.(CVE-2020-10543)

  - regcomp.c in Perl before 5.30.3 allows a buffer     overflow via a crafted regular expression because of     recursive S_study_chunk calls.(CVE-2020-12723)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Perl before 5.30.3 has an integer overflow related to     mishandling of a 'PL_regkind[OP(n)] == NOTHING'     situation. A crafted regular expression could lead to     malformed bytecode with a possibility of instruction     injection.(CVE-2020-10878)

  - regcomp.c in Perl before 5.30.3 allows a buffer     overflow via a crafted regular expression because of     recursive S_study_chunk calls.(CVE-2020-12723)

  - Perl before 5.30.3 on 32-bit platforms allows a     heap-based buffer overflow because nested regular     expression quantifiers have an integer     overflow.(CVE-2020-10543)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Perl before 5.30.3 on 32-bit platforms allows a     heap-based buffer overflow because nested regular     expression quantifiers have an integer     overflow.(CVE-2020-10543)

  - Perl before 5.30.3 has an integer overflow related to     mishandling of a 'PL_regkind[OP(n)] == NOTHING'     situation. A crafted regular expression could lead to     malformed bytecode with a possibility of instruction     injection.(CVE-2020-10878)

  - regcomp.c in Perl before 5.30.3 allows a buffer     overflow via a crafted regular expression because of     recursive S_study_chunk calls.(CVE-2020-12723)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1678 advisory.

    Perl is a high-level programming language that is commonly used for system administration utilities and     web programming.

    Security Fix(es):

    * perl: heap-based buffer overflow in regular expression compiler leads to DoS (CVE-2020-10543)

    * perl: corruption of intermediate language state of compiled regular expression due to integer overflow     leads to DoS (CVE-2020-10878)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Fixed CVE-2020-10543, CVE-2020-10878 and CVE-2020-12723

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the perl package has been released.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2021_1678 advisory.

    * perl: heap-based buffer overflow in regular expression compiler leads to DoS (CVE-2020-10543)

    * perl: corruption of intermediate language state of compiled regular expression due to integer overflow     leads to DoS (CVE-2020-10878)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
144314	AIX 7.1 TL 5 : perl (IJ26985)	Nessus	AIX Local Security Checks	12/16/2020	2/6/2024	high
154556	NewStart CGSL MAIN 6.02 : perl Multiple Vulnerabilities (NS-SA-2021-0134)	Nessus	NewStart CGSL Local Security Checks	10/27/2021	4/30/2026	high
151395	EulerOS Virtualization 3.0.2.2 : perl (EulerOS-SA-2021-2157)	Nessus	Huawei Local Security Checks	7/6/2021	12/11/2023	high
146623	Amazon Linux 2 : perl (ALAS-2021-1610)	Nessus	Amazon Linux Local Security Checks	2/19/2021	12/11/2024	high
140164	EulerOS 2.0 SP5 : perl (EulerOS-SA-2020-1943)	Nessus	Huawei Local Security Checks	9/2/2020	2/22/2024	high
140337	EulerOS Virtualization for ARM 64 3.0.2.0 : perl (EulerOS-SA-2020-1967)	Nessus	Huawei Local Security Checks	9/8/2020	2/21/2024	high
140852	EulerOS 2.0 SP3 : perl (EulerOS-SA-2020-2085)	Nessus	Huawei Local Security Checks	9/28/2020	2/19/2024	high
149678	RHEL 8 : perl (RHSA-2021:1678)	Nessus	Red Hat Local Security Checks	5/19/2021	4/30/2026	high
137437	Fedora 31 : 4:perl (2020-fd73c08076)	Nessus	Fedora Local Security Checks	6/17/2020	4/30/2026	high
148028	Photon OS 4.0: Perl PHSA-2021-4.0-0006	Nessus	PhotonOS Local Security Checks	3/24/2021	8/22/2025	high
358811	Rocky Linux 8 [CIQ] Security Update: perl / perl-Attribute-Handlers / perl-Devel-Peek / etc Multiple Vulnerabilities (crlsa-2021_1678)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/2/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high