CVE-2010-1158

Publication date 20 April 2010

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

Integer overflow in the regular expression engine in Perl 5.8.x allows context-dependent attackers to cause a denial of service (stack consumption and application crash) by matching a crafted regular expression against a long string.

Read the notes from the security team

Status

Package Ubuntu Release Status
perl 10.04 LTS lucid
Not affected
9.10 karmic
Not affected
9.04 jaunty
Not affected
8.10 intrepid
Not affected
8.04 LTS hardy Ignored
6.06 LTS dapper Ignored

Notes

mdeslaur

this is a denial of service issue that stems from the re engine being recursive. The engine was rewritten in 5.10, and the patch is intrusive so backporting it may be more trouble than it's worth. Marking as ignored for now since this is more a limitation in the engine design than a security issue.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
perl