CVE-2010-1158

Published: 20 April 2010

Integer overflow in the regular expression engine in Perl 5.8.x allows context-dependent attackers to cause a denial of service (stack consumption and application crash) by matching a crafted regular expression against a long string.

Notes

this is a denial of service issue that stems from the re engine
being recursive. The engine was rewritten in 5.10, and the
patch is intrusive so backporting it may be more trouble than
it's worth. Marking as ignored for now since this is more a
limitation in the engine design than a security issue.

Status

References

• http://perldoc.perl.org/perl5100delta.html
• https://www.cve.org/CVERecord?id=CVE-2010-1158
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=580605
• http://bugs.gentoo.org/show_bug.cgi?id=313565