Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow
because nested regular expression quantifiers have an integer overflow.
An application written in Perl would only be vulnerable to this flaw if
it evaluates regular expressions supplied by the attacker. Evaluating
regular expressions in this fashion is known to be dangerous since the
regular expression engine does not protect against denial of service
attacks in this usage scenario.
Additionally, the target system needs a sufficient amount of memory to
allocate partial expansions of the nested quantifiers prior to the
overflow occurring. This requirement is unlikely to be met on 64bit
amurrayAffects 5.005 to 5.30.2
Source: perl (LP Ubuntu Debian)
Upstream:released (5.28.3,5.30.3)
Ubuntu 12.04 ESM (Precise Pangolin):needed
Ubuntu 14.04 ESM (Trusty Tahr):needed
Ubuntu 16.04 LTS (Xenial Xerus):needed
Ubuntu 18.04 LTS (Bionic Beaver):needed
Ubuntu 20.04 LTS (Focal Fossa):needed
Ubuntu 20.10 (Groovy Gorilla):not-affected (5.30.3-4)
More Information

Updated: 2020-09-09 23:34:11 UTC (commit 81a23a978c4436cd99e1d040e9e73e9146876281)