CVE-2020-10878

At a glance

Severity: Not available
EPSS: EPSS 4.88 % · percentile 92 (2026-10-27)
State: PUBLISHED
Published: 2020-06-05
Updated: 2026-10-14
Assigner: mitre
NVD status: Modified

Description

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 8.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H	NVD · nvd@nist.gov (Primary)
CVSS 2.0	HIGH 7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P	NVD · nvd@nist.gov (Primary)

Weaknesses (CWE)

CWE-190

European references

ENISA EUVD · EUVD-2020-3284
GCVE · GCVE-0-2020-10878

CERT-FR advisories

CERTFR-2026-AVI-0424 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-0218 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2025-AVI-0756 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2023-AVI-1015 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
CERTFR-2022-AVI-650 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
CERTFR-2022-AVI-111 — Multiples vulnérabilités dans F5 BIG-IP et BIG-IQ · cert.ssi.gouv.fr
CERTFR-2021-AVI-791 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2021-AVI-638 — Multiples vulnérabilités dans Juniper Junos Space · cert.ssi.gouv.fr
CERTFR-2021-AVI-589 — Multiples vulnérabilités dans Juniper Junos Space Log Collector · cert.ssi.gouv.fr
CERTFR-2021-AVI-556 — Multiples vulnérabilités dans Oracle Database Server · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:* < 5.30.3
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.2.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* ≥ 8.0.0 ≤ 8.5.0
cpe:2.3:a:oracle:communications_eagle_application_processor:*:*:*:*:*:*:*:* ≥ 16.1.0 ≤ 16.4.0
cpe:2.3:a:oracle:communications_eagle_lnp_application_processor:10.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_eagle_lnp_application_processor:10.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_eagle_lnp_application_processor:46.7:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_eagle_lnp_application_processor:46.8:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_eagle_lnp_application_processor:46.9:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_lsms:*:*:*:*:*:*:*:* ≥ 13.1 ≤ 13.4
cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_performance_intelligence_center:*:*:*:*:*:*:*:* ≥ 10.3.0.0.0 ≤ 10.3.0.2.1
cpe:2.3:a:oracle:communications_performance_intelligence_center:*:*:*:*:*:*:*:* ≥ 10.4.0.1.0 ≤ 10.4.0.3.1
cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:configuration_manager:12.1.2.0.8:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:sd-wan_aware:8.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:sd-wan_aware:9.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:sd-wan_aware:9.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:tekelec_platform_distribution:*:*:*:*:*:*:*:* ≥ 7.4.0 ≤ 7.7.1

Affected products

Product	Versions
	affected n/a

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD