Integer overflow in perl (Alpine package)

1) Integer overflow

EUVDB-ID: #VU29015

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-10878

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A remote attacker can use a specially crafted regular expression, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

WordPress Gallery Plugin - NextGEN Gallery: 2.1.0

perl (Alpine package): 0.8.9 - 1.2.1

perl (Alpine package): 1.1.47

perl (Alpine package): 20101020ubuntu213 - 20101020ubuntu451.6

perl (Alpine package): 0.2.69 - 1.4.41

perl (Alpine package): 0.0.1daily13.06.18-0ubuntu1 - 5.0.0-0ubuntu2

perl (Alpine package): 0.4.17 - 0.5.8-1

perl (Alpine package): 0.2.12-1

perl (Alpine package): 7.11.0-3 - 7.26.0-1ubuntu1

perl (Alpine package): 1.0.59-1

perl (Alpine package): 0.7.1-0ubuntu4 - 0.7.1-0ubuntu5

perl (Alpine package): 2.01-1

perl (Alpine package): 4.1-2851

perl (Alpine package): 2.5.1

perl (Alpine package): 1.4.12.1

perl (Alpine package): 2.1.4

perl (Alpine package): 0.7.7

perl (Alpine package): 7.6.6

perl (Alpine package):

perl (Alpine package): before 5.26.3-r1

CPE2.3

• cpe:2.3:a:imagely:nextgen-gallery:2.1.0:*:*:*:*:wordpress:*:*
• cpe:2.3:o:alpine:perl_alpine_package:0.8.9:*:*:*:*:alpine_linux:*:*
• cpe:2.3:o:alpine:perl_alpine_package:1.2.1:*:*:*:*:alpine_linux:*:*
• cpe:2.3:o:alpine:perl_alpine_package:1.1.47:*:*:*:*:alpine_linux:*:*
• cpe:2.3:o:alpine:perl_alpine_package:20101020ubuntu213:*:*:*:*:alpine_linux:*:*
• cpe:2.3:o:alpine:perl_alpine_package:20101020ubuntu306:*:*:*:*:alpine_linux:*:*
• cpe:2.3:o:alpine:perl_alpine_package:20101020ubuntu307:*:*:*:*:alpine_linux:*:*
• cpe:2.3:o:alpine:perl_alpine_package:0.2.69:*:*:*:*:alpine_linux:*:*
• cpe:2.3:o:alpine:perl_alpine_package:0.2.70:*:*:*:*:alpine_linux:*:*
• cpe:2.3:o:alpine:perl_alpine_package:0.9.74:*:*:*:*:alpine_linux:*:*
• cpe:2.3:o:alpine:perl_alpine_package:0.0.1daily13.06.18-0ubuntu1:*:*:*:*:alpine_linux:*:*
• cpe:2.3:o:alpine:perl_alpine_package:0.4.17:*:*:*:*:alpine_linux:*:*
• cpe:2.3:o:alpine:perl_alpine_package:0.2.12-1:*:*:*:*:alpine_linux:*:*
• cpe:2.3:o:alpine:perl_alpine_package:7.11.0-3:*:*:*:*:alpine_linux:*:*
• cpe:2.3:o:alpine:perl_alpine_package:1.0.59-1:*:*:*:*:alpine_linux:*:*
• cpe:2.3:o:alpine:perl_alpine_package:0.7.1-0ubuntu4:*:*:*:*:alpine_linux:*:*
• cpe:2.3:o:alpine:perl_alpine_package:2.01-1:*:*:*:*:alpine_linux:*:*
• cpe:2.3:o:alpine:perl_alpine_package:4.1-2851:*:*:*:*:alpine_linux:*:*
• cpe:2.3:o:alpine:perl_alpine_package:2.5.1:*:*:*:*:alpine_linux:*:*
• cpe:2.3:o:alpine:perl_alpine_package:1.4.12.1:*:*:*:*:alpine_linux:*:*
• cpe:2.3:o:alpine:perl_alpine_package:2.1.4:*:*:*:*:alpine_linux:*:*
• cpe:2.3:o:alpine:perl_alpine_package:0.7.7:*:*:*:*:alpine_linux:*:*
• cpe:2.3:o:alpine:perl_alpine_package:7.6.6:*:*:*:*:alpine_linux:*:*
• cpe:2.3:o:alpine:perl_alpine_package::*:*:*:*:alpine_linux:*:*
• cpe:2.3:o:alpine:perl_alpine_package:*:*:*:*:*:alpine_linux:*:3.9

External links

https://git.alpinelinux.org/aports/commit/?id=2347c5642490c5f7dc79c2205fff672b7bf5a3f6
https://git.alpinelinux.org/aports/commit/?id=2db22e01ffdcff6cb673b0f5660cb911cff79bc1
https://git.alpinelinux.org/aports/commit/?id=d5907c68b2341579983e3fc9a25ac4b67162c994
https://git.alpinelinux.org/aports/commit/?id=f4e478f351ceedb178ec76b3b5ba2b2defdf99c8
https://git.alpinelinux.org/aports/commit/?id=0bae63fd8d47db4b5bf4e1407c139f804fa62f4f

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.