The Perl_reg_numbered_buff_fetch function in Perl 5.10.0, 5.12.0, 5.14.0, and other versions, when running with debugging enabled, allows context-dependent attackers to cause a denial of service (assertion failure and application exit) via crafted input that is not properly handled when using certain regular expressions, as demonstrated by causing SpamAssassin and OCSInventory to crash.

This update fixes a bug in perl that makes spamassassin crash and does not allow bypassing taint mode by using lc() or uc() anymore.

  - CVE-2010-4777: CVSS v2 Base Score: 5.0     (AV:N/AC:L/Au:N/C:N/I:N/A:P)

  - CVE-2011-1487: CVSS v2 Base Score: 2.6     (AV:N/AC:H/Au:N/C:N/I:P/A:N): Permissions, Privileges,     and Access Control (CWE-264)

This update fixes a bug in Perl that makes spamassassin crash and does not allow bypassing taint mode by using lc() or uc() anymore.

  - CVE-2010-4777: CVSS v2 Base Score: 5.0     (AV:N/AC:L/Au:N/C:N/I:N/A:P)

  - CVE-2011-1487: CVSS v2 Base Score: 2.6     (AV:N/AC:H/Au:N/C:N/I:P/A:N): Permissions, Privileges,     and Access Control (CWE-264)

ID	Name	Product	Family	Severity
75993	openSUSE Security Update : perl (openSUSE-SU-2011:0479-1)	Nessus	SuSE Local Security Checks	medium
75706	openSUSE Security Update : perl (openSUSE-SU-2011:0479-1)	Nessus	SuSE Local Security Checks	medium
53892	SuSE 11.1 Security Update : Perl (SAT Patch Number 4499)	Nessus	SuSE Local Security Checks	medium
53887	openSUSE Security Update : perl (openSUSE-SU-2011:0479-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2010-4777

high

Tenable Plugins

medium

medium

medium

medium