The remote host is affected by the vulnerability described in GLSA-202006-03 (Perl: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Perl. Please review the       CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

An update of the perl package has been released.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4602-1 advisory.

    ManhND discovered that Perl incorrectly handled certain regular expressions. In environments where     untrusted regular expressions are evaluated, a remote attacker could possibly use this issue to cause Perl     to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2020-10543)

    Hugo van der Sanden and Slaven Rezic discovered that Perl incorrectly handled certain regular expressions.
    In environments where untrusted regular expressions are evaluated, a remote attacker could possibly use     this issue to cause Perl to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2020-10878)

    Sergey Aleynikov discovered that Perl incorrectly handled certain regular expressions. In environments     where untrusted regular expressions are evaluated, a remote attacker could possibly use this issue to     cause Perl to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2020-12723)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Heap-based buffer overflow in the pack function in Perl     before 5.26.2 allows context-dependent attackers to     execute arbitrary code via a large item     count.(CVE-2018-6913)

  - regcomp.c in Perl before 5.30.3 allows a buffer     overflow via a crafted regular expression because of     recursive S_study_chunk calls.(CVE-2020-12723)

  - Perl before 5.30.3 on 32-bit platforms allows a     heap-based buffer overflow because nested regular     expression quantifiers have an integer     overflow.(CVE-2020-10543)

  - Perl before 5.30.3 has an integer overflow related to     mishandling of a 'PL_regkind[OP(n)] == NOTHING'     situation. A crafted regular expression could lead to     malformed bytecode with a possibility of instruction     injection.(CVE-2020-10878)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:1678 advisory.

  - Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular     expression quantifiers have an integer overflow. (CVE-2020-10543)

  - Perl before 5.30.3 has an integer overflow related to mishandling of a PL_regkind[OP(n)] == NOTHING     situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction     injection. (CVE-2020-10878)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9238 advisory.

    - Backport patch for CVE-2020-10543    [Orabug: 32855589]
    - Backport patch for CVE-2020-10878    [Orabug: 32855589]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10543 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10543 Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow. Perl before 5.30.3 has an integer overflow related to mishandling of a 'PL_regkind[OP(n)] == NOTHING' situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection. regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

The remote NewStart CGSL host, running version MAIN 6.02, has perl packages installed that are affected by multiple vulnerabilities:

  - Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular     expression quantifiers have an integer overflow. (CVE-2020-10543)

  - Perl before 5.30.3 has an integer overflow related to mishandling of a PL_regkind[OP(n)] == NOTHING     situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction     injection. (CVE-2020-10878)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the perl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Perl might allow context-dependent attackers to bypass     the taint protection mechanism in a child process via     duplicate environment variables in envp.(CVE-2016-2381)

  - Perl before 5.30.3 on 32-bit platforms allows a     heap-based buffer overflow because nested regular     expression quantifiers have an integer     overflow.(CVE-2020-10543)

  - Perl before 5.30.3 has an integer overflow related to     mishandling of a 'PL_regkind[OP(n)] == NOTHING'     situation. A crafted regular expression could lead to     malformed bytecode with a possibility of instruction     injection.(CVE-2020-10878)

  - regcomp.c in Perl before 5.30.3 allows a buffer     overflow via a crafted regular expression because of     recursive S_study_chunk calls.(CVE-2020-12723)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of perl installed on the remote host is prior to 5.16.3-299. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1610 advisory.

    Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular     expression quantifiers have an integer overflow. (CVE-2020-10543)

    Perl before 5.30.3 has an integer overflow related to mishandling of a PL_regkind[OP(n)] == NOTHING     situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction     injection. (CVE-2020-10878)

    regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of     recursive S_study_chunk calls. (CVE-2020-12723)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
137383	GLSA-202006-03 : Perl: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	6/12/2020	4/30/2026	high
137719	Photon OS 2.0: Perl PHSA-2020-2.0-0254	Nessus	PhotonOS Local Security Checks	6/22/2020	4/30/2026	high
141913	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Perl vulnerabilities (USN-4602-1)	Nessus	Ubuntu Local Security Checks	10/27/2020	8/27/2024	high
142313	EulerOS 2.0 SP2 : perl (EulerOS-SA-2020-2380)	Nessus	Huawei Local Security Checks	11/3/2020	12/5/2022	critical
184937	Rocky Linux 8 : perl (RLSA-2021:1678)	Nessus	Rocky Linux Local Security Checks	11/7/2023	4/30/2026	high
149822	Oracle Linux 6 : perl (ELSA-2021-9238)	Nessus	Oracle Linux Local Security Checks	5/21/2021	10/22/2024	high
144314	AIX 7.1 TL 5 : perl (IJ26985)	Nessus	AIX Local Security Checks	12/16/2020	2/6/2024	high
154556	NewStart CGSL MAIN 6.02 : perl Multiple Vulnerabilities (NS-SA-2021-0134)	Nessus	NewStart CGSL Local Security Checks	10/27/2021	4/30/2026	high
151395	EulerOS Virtualization 3.0.2.2 : perl (EulerOS-SA-2021-2157)	Nessus	Huawei Local Security Checks	7/6/2021	12/11/2023	high
146623	Amazon Linux 2 : perl (ALAS-2021-1610)	Nessus	Amazon Linux Local Security Checks	2/19/2021	12/11/2024	high

Detections

Analytics

Plugins Search

high

high

high

critical

high

high

high

high

high

high