CVE-2020-12723 @ Saiph
Status
new
Priority
0.62
Match score
4.0
Risk
DoS
Remote
CVSS
7.5 HIGH
Reason
cpe: perl; pkgs: perl; version: in-range: perl-5.28.1-6+deb10u1, perl-base-5.28.1-6+deb10u1, perl-modules-5.20.2-3+deb8u7, perl-modules-5.24-5.24.1-3+deb9u5, perl-modules-5.28-5.28.1-6+deb10u1; risk:dos
Created
2026-10-15T10:20:43Z
Updated
2026-10-20T10:18:51Z
Package interrogation (copy)
Run on the host — click to copy a command. Debian/apt
| Package | Commands |
|---|---|
| perl-5.28.1-6+deb10u1 | |
| perl-base-5.28.1-6+deb10u1 | |
| perl-modules-5.20.2-3+deb8u7 | |
| perl-modules-5.24-5.24.1-3+deb9u5 | |
| perl-modules-5.28-5.28.1-6+deb10u1 | |
| libalgorithm-diff-perl-1.19.03-2 | |
| libalgorithm-diff-xs-perl-0.04-5+b1 | |
| libalgorithm-merge-perl-0.08-3 | |
| libbit-vector-perl-7.4-1+b5 | |
| libcarp-clan-perl-6.07-1 | |
| libcgi-fast-perl-1:2.13-1 | |
| libcgi-pm-perl-4.40-1 | |
| libconfig-inifiles-perl-3.000001-1 | |
| libdate-calc-perl-6.4-1 | |
| libdate-calc-xs-perl-6.4-1+b4 | |
| libdate-manip-perl-6.76-1 | |
| libdbd-mysql-perl-4.050-2 | |
| libdbi-perl-1.642-1+deb10u2 | |
| libdpkg-perl-1.19.8 | |
| libencode-locale-perl-1.05-1 | |
| liberror-perl-0.17027-2 | |
| libfcgi-perl-0.78-2+b3 | |
| libfile-fcntllock-perl-0.22-3+b5 | |
| libfile-tail-perl-1.3-5 | |
| libhtml-parser-perl-3.72-3+b3 | |
| libhtml-tagset-perl-3.20-3 | |
| libhtml-template-perl-2.97-1 | |
| libhttp-date-perl-6.02-1 | |
| libhttp-message-perl-6.18-1 | |
| libio-html-perl-1.001-1 | |
| liblocale-gettext-perl-1.07-3+b4 | |
| liblwp-mediatypes-perl-6.02-1 | |
| libmodule-build-perl-0.422000-1 | |
| libperl5.28-5.28.1-6+deb10u1 | |
| libpod-latex-perl-0.61-2 |
Inventory lookup
Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.
Suggestions: perl · perl-base · perl-modules
Related CVE (same fix)
Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.
Host OS / kernel
OS
Debian GNU/Linux 10 (buster)
(10)
· debian
Arch
x86_64
kernel_release
uname -r → 4.19.0-27-amd64kernel_version
uname -v → #1 SMP Debian 4.19.316-1 (2024-06-25)For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.
Same CVE on other hosts
Open the ticket for this CVE on another system.
| System | Status | Priority | Updated | |
|---|---|---|---|---|
| morris | new | 7.0 | 2026-10-20T10:18:51Z | Open |
| mufasa | new | 7.0 | 2026-10-20T10:18:51Z | Open |
| Library | new | 1.75 | 2026-10-20T10:18:51Z | Open |
| Archive | new | 0.62 | 2026-10-20T10:18:51Z | Open |
| Janus | new | 0.62 | 2026-10-20T10:18:51Z | Open |
Description
regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.
Update status
Add note only
References
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html
- https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod
- https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3
- https://github.com/Perl/perl5/issues/16947
- https://github.com/Perl/perl5/issues/17743
- https://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/
- https://security.gentoo.org/glsa/202006-03
- https://security.netapp.com/advisory/ntap-20200611-0001/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
NVD: CVE-2020-12723