CVEs-PoC/2020/CVE-2020-10878.md

CVE-2020-10878

Description

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

POC

Reference

• https://www.oracle.com//security-alerts/cpujul2021.html
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujan2021.html
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpuoct2020.html
• https://www.oracle.com/security-alerts/cpuoct2021.html

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/Azure/publish-security-assessments
• https://github.com/actions-marketplace-validations/Azure_publish-security-assessments
• https://github.com/binxio/gcr-kritis-signer
• https://github.com/dragon7-fc/misc
• https://github.com/garethr/snykout
• https://github.com/hisashin0728/AmazonECRScanSecurityHub
• https://github.com/hstiwana/cks
• https://github.com/snigdhasambitak/cks