Skip to content
OpenAdvisories
Medium ALAS2-2021-1610 3 CVEs

Moderate: perl security update (Amazon Linux 2)

Published Feb 19, 2021 · Updated Feb 19, 2021

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-12723: regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls. 1838000: CVE-2020-12723 perl: corruption of intermediate language state of compiled regular expression due to recursive S_study_chunk() calls leads to DoS CVE-2020-10878: Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection. 1837988: CVE-2020-10878 perl: corruption of intermediate language state of compiled regular expression due to integer overflow leads to DoS CVE-2020-10543: Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow. 1837975: CVE-2020-10543 perl: heap-based buffer overflow in regular expression compiler leads to DoS

Fixed packages 19

ReleasePackageFixed in
Amazon Linux · 2 perl 4:5.16.3-299.amzn2.0.1
Amazon Linux · 2 perl-core 0:5.16.3-299.amzn2.0.1
Amazon Linux · 2 perl-CPAN 0:1.9800-299.amzn2.0.1
Amazon Linux · 2 perl-debuginfo 4:5.16.3-299.amzn2.0.1
Amazon Linux · 2 perl-devel 4:5.16.3-299.amzn2.0.1
Amazon Linux · 2 perl-ExtUtils-CBuilder 1:0.28.2.6-299.amzn2.0.1
Amazon Linux · 2 perl-ExtUtils-Embed 0:1.30-299.amzn2.0.1
Amazon Linux · 2 perl-ExtUtils-Install 0:1.58-299.amzn2.0.1
Amazon Linux · 2 perl-IO-Zlib 1:1.10-299.amzn2.0.1
Amazon Linux · 2 perl-libs 4:5.16.3-299.amzn2.0.1
Amazon Linux · 2 perl-Locale-Maketext-Simple 1:0.21-299.amzn2.0.1
Amazon Linux · 2 perl-macros 4:5.16.3-299.amzn2.0.1
Amazon Linux · 2 perl-Module-CoreList 1:2.76.02-299.amzn2.0.1
Amazon Linux · 2 perl-Module-Loaded 1:0.08-299.amzn2.0.1
Amazon Linux · 2 perl-Object-Accessor 1:0.42-299.amzn2.0.1
Amazon Linux · 2 perl-Package-Constants 1:0.02-299.amzn2.0.1
Amazon Linux · 2 perl-Pod-Escapes 1:1.04-299.amzn2.0.1
Amazon Linux · 2 perl-tests 4:5.16.3-299.amzn2.0.1
Amazon Linux · 2 perl-Time-Piece 0:1.20.1-299.amzn2.0.1

Vulnerabilities 3

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-10543.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-10878.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-12723.html