CVE-2020-10878

Perl before 5.30.3 has an integer overflow related to mishandling of a
“PL_regkind[OP(n)] == NOTHING” situation. A crafted regular expression
could lead to malformed bytecode with a possibility of instruction
injection.
An application written in Perl would only be vulnerable to this flaw if
it evaluates regular expressions supplied by the attacker. Evaluating
regular expressions in this fashion is known to be dangerous since the
regular expression engine does not protect against denial of service
attacks in this usage scenario.]

Bugs

• <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=962005&gt;

Notes