CVE Feed

Dashboard / CVE / CVE-2005-3962

CVE-2005-3962

Integer overflow in the format string functionality (Perl_sv_vcatpvfn) in Perl 5.9.2 and 5.8.6 Perl allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via format string specifiers with large values, which causes an integer wrap and leads to a buffer overflow, as demonstrated using format string vulnerabilities in Perl applications.

Published:Dec 1, 2005

Last Modified:Apr 16, 2026

EPS:Dec 1, 2005

EPSS Score:0.00894

CVSS Score:4.6

Affected Products

Vendor

Product

Action

Vendor

Perl

Product

Perl

Perl

Perl

Vendor

Redhat

Product

Enterprise Linux

Redhat

Enterprise Linux

Exploits

No exploit reference

Common Weakness Enumeration

No CWE recorded yet

Common Attack Pattern Enumeration and Classification (CAPEC)

No CAPEC recorded yet

Related CVEs

CVE-2026-19487 (CVSS 5.3) — Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure…

CVE-2026-13221 (CVSS 9.1) — Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently in…

CVE-2026-57432 (CVSS 8.4) — Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer ove…

CVE-2026-8376 (CVSS 9.8) — Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer …

CVE-2026-4176 (CVSS 9.8) — Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a…

CVE-2025-11683 (CVSS 6.5) — YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and pote…

CVE-2025-40909 (CVSS 5.9) — Perl threads have a working directory race condition where file operations may target unintended paths. If a …

CVE-2024-56406 (CVSS 8.4) — A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are …

CVE-2021-47155 (CVSS 9.1) — The Net::IPV4Addr module 0.10 for Perl does not properly consider extraneous zero characters in an IP address …

CVE-2023-47039 (CVSS 7.8) — A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path…

References

ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/007_perl.patch

ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/001_perl.patch

ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=001056

http://docs.info.apple.com/article.html?artnum=304829

http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html

http://marc.info/?l=full-disclosure&m=113342788118630&w=2

http://secunia.com/advisories/17762

http://secunia.com/advisories/17802

http://secunia.com/advisories/17844

http://secunia.com/advisories/17941

http://secunia.com/advisories/17952

http://secunia.com/advisories/17993

http://secunia.com/advisories/18075

http://secunia.com/advisories/18183

http://secunia.com/advisories/18187

http://secunia.com/advisories/18295

http://secunia.com/advisories/18413

http://secunia.com/advisories/18517

http://secunia.com/advisories/19041

http://secunia.com/advisories/20894

http://secunia.com/advisories/23155

http://secunia.com/advisories/31208

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102192-1

http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm

http://www.debian.org/security/2006/dsa-943

http://www.dyadsecurity.com/perl-0002.html

http://www.gentoo.org/security/en/glsa/glsa-200512-01.xml

http://www.ipcop.org/index.php?name=News&file=article&sid=41

http://www.kb.cert.org/vuls/id/948385

http://www.mandriva.com/security/advisories?name=MDKSA-2005:225

http://www.novell.com/linux/security/advisories/2005_29_sr.html

http://www.novell.com/linux/security/advisories/2005_71_perl.html

http://www.openbsd.org/errata37.html#perl

http://www.openpkg.org/security/OpenPKG-SA-2005.025-perl.html

http://www.osvdb.org/21345

http://www.osvdb.org/22255

http://www.redhat.com/support/errata/RHSA-2005-880.html

http://www.redhat.com/support/errata/RHSA-2005-881.html

http://www.securityfocus.com/archive/1/418333/100/0/threaded

http://www.securityfocus.com/archive/1/438726/100/0/threaded

http://www.securityfocus.com/bid/15629

http://www.trustix.org/errata/2005/0070

http://www.us-cert.gov/cas/techalerts/TA06-333A.html

http://www.vupen.com/english/advisories/2005/2688

http://www.vupen.com/english/advisories/2006/0771

http://www.vupen.com/english/advisories/2006/2613

http://www.vupen.com/english/advisories/2006/4750

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10598

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1074

https://usn.ubuntu.com/222-1/

https://www.redhat.com/archives/fedora-legacy-announce/2006-February/msg00008.html

ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/007_perl.patch

ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/001_perl.patch

ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=001056

http://docs.info.apple.com/article.html?artnum=304829

http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html

http://marc.info/?l=full-disclosure&m=113342788118630&w=2

http://secunia.com/advisories/17762

http://secunia.com/advisories/17802

http://secunia.com/advisories/17844

http://secunia.com/advisories/17941

http://secunia.com/advisories/17952

http://secunia.com/advisories/17993

http://secunia.com/advisories/18075

http://secunia.com/advisories/18183

http://secunia.com/advisories/18187

http://secunia.com/advisories/18295

http://secunia.com/advisories/18413

http://secunia.com/advisories/18517

http://secunia.com/advisories/19041

http://secunia.com/advisories/20894

http://secunia.com/advisories/23155

http://secunia.com/advisories/31208

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102192-1

http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm

http://www.debian.org/security/2006/dsa-943

http://www.dyadsecurity.com/perl-0002.html

http://www.gentoo.org/security/en/glsa/glsa-200512-01.xml

http://www.ipcop.org/index.php?name=News&file=article&sid=41

http://www.kb.cert.org/vuls/id/948385

http://www.mandriva.com/security/advisories?name=MDKSA-2005:225

http://www.novell.com/linux/security/advisories/2005_29_sr.html

http://www.novell.com/linux/security/advisories/2005_71_perl.html

http://www.openbsd.org/errata37.html#perl

http://www.openpkg.org/security/OpenPKG-SA-2005.025-perl.html

http://www.osvdb.org/21345

http://www.osvdb.org/22255

http://www.redhat.com/support/errata/RHSA-2005-880.html

http://www.redhat.com/support/errata/RHSA-2005-881.html

http://www.securityfocus.com/archive/1/418333/100/0/threaded

http://www.securityfocus.com/archive/1/438726/100/0/threaded

http://www.securityfocus.com/bid/15629

http://www.trustix.org/errata/2005/0070

http://www.us-cert.gov/cas/techalerts/TA06-333A.html

http://www.vupen.com/english/advisories/2005/2688

http://www.vupen.com/english/advisories/2006/0771

http://www.vupen.com/english/advisories/2006/2613

http://www.vupen.com/english/advisories/2006/4750

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10598

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1074

https://usn.ubuntu.com/222-1/

https://www.redhat.com/archives/fedora-legacy-announce/2006-February/msg00008.html

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High