CVE-2013-10076
Publication date 12 October 2026
Last updated 12 October 2026
Ubuntu priority
Description
ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slots, leading to memory exhaustion.
Why is this CVE medium priority?
Memory exhaustion denial of service in a Perl XS typemap when an empty list is processed; exposure depends on applications using the typemap.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| libextutils-typemaps-default-perl | 26.04 LTS resolute |
Needs evaluation
|
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release |
References
Other references
- https://www.cve.org/CVERecord?id=CVE-2013-10076
- cpan.org/modules
- github.com/tsee/extutils-typemap-default
- github.com/tsee/extutils-typemap-default/commit/0eb696b75afcfedbf87a72e11d44d98110863934
- lists.security.metacpan.org/cve-announce/msg/44246011
- rt.cpan.org/public/bug/display.html?id=91213
- security-tracker.debian.org/tracker/cve-2013-10076