CVE-2020-10878

Severity: high (CVSS 8.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-06-05 · updated 2026-10-14
Weakness: CWE-190

Description

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

Affected products

Fedoraproject Fedora: 31
NetApp OnCommand Workflow Automation: all versions
NetApp Snap Creator Framework: all versions
openSUSE Leap: 15.1
Oracle Corporation Communications Billing and Revenue Management: 12.0.0.2.0, 12.0.0.3.0
Oracle Corporation Communications Diameter Signaling Router (DSR): from 8.0.0 through 8.5.0
Oracle Communications Eagle Application Processor: from 16.1.0 through 16.4.0
Oracle Communications Eagle Lnp Application Processor: 10.1, 10.2, 46.7, 46.8, 46.9
Oracle Communications Lsms: from 13.1 through 13.4
Oracle Communications Offline Mediation Controller: 12.0.0.3.0
Oracle Communications Performance Intelligence Center: from 10.3.0.0.0 through 10.3.0.2.1; from 10.4.0.1.0 through 10.4.0.3.1
Oracle Corporation Communications Pricing Design Center: 12.0.0.3.0
Oracle Corporation Configuration Manager: 12.1.2.0.8
Oracle Corporation Enterprise Manager Base Platform: 13.4.0.0
Oracle Corporation SD-WAN Aware: 8.2, 9.0, 9.1
Oracle Tekelec Platform Distribution: from 7.4.0 through 7.7.1
perl: before 5.30.3 — fixed in 5.30.3

How to fix

Upgrade to a fixed version: perl 5.30.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-10878 or the next vulnerability affects your stack