CVE-2010-4777

NameCVE-2010-4777
DescriptionThe Perl_reg_numbered_buff_fetch function in Perl 5.10.0, 5.12.0, 5.14.0, and other versions, when running with debugging enabled, allows context-dependent attackers to cause a denial of service (assertion failure and application exit) via crafted input that is not properly handled when using certain regular expressions, as demonstrated by causing SpamAssassin and OCSInventory to crash.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium (attack range: remote)
Debian Bugs628836

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
perl (PTS)wheezy5.14.2-21+deb7u3vulnerable
wheezy (security)5.14.2-21+deb7u5vulnerable
jessie (security), jessie5.20.2-3+deb8u9fixed
stretch (security), stretch5.24.1-3+deb9u2fixed
buster, sid5.26.1-4fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
perlsource(unstable)5.20.1-1unimportant628836

Notes

Only affects Perl builds with enabled assertions, i.e. the debugperl binary from perl-debug
likely fixed sometime around 5.18, but 5.20 was the version checked

Search for package or bug name: Reporting problems