CVE-2010-4777

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-02-10 · updated 2026-06-16
Weakness: CWE-20

Description

The Perl_reg_numbered_buff_fetch function in Perl 5.10.0, 5.12.0, 5.14.0, and other versions, when running with debugging enabled, allows context-dependent attackers to cause a denial of service (assertion failure and application exit) via crafted input that is not properly handled when using certain regular expressions, as demonstrated by causing SpamAssassin and OCSInventory to crash.

Affected products

perl: 5.10, 5.12.0, 5.14.0

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=628836
http://forums.ocsinventory-ng.org/viewtopic.php?id=7215
http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
http://lists.opensuse.org/opensuse-updates/2011-05/msg00025.html
https://bugzilla.redhat.com/show_bug.cgi?id=694166
https://listi.jpberlin.de/pipermail/postfixbuch-users/2011-February/055885.html
https://rt.perl.org/Public/Bug/Display.html?id=76538
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=628836
http://forums.ocsinventory-ng.org/viewtopic.php?id=7215
http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
http://lists.opensuse.org/opensuse-updates/2011-05/msg00025.html
https://bugzilla.redhat.com/show_bug.cgi?id=694166

Get alerted when CVE-2010-4777 or the next vulnerability affects your stack