CVE Feed

    Dashboard / CVE / CVE-2011-2939

    CVE-2011-2939

    Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.

    Published:Aug 9, 2011
    Last Modified:Apr 11, 2025
    EPS:Jan 13, 2012
    EPSS Score:0.02324
    CVSS Score:5.1

    Affected Products

    Vendor
    Dan Kogai
    Product
    Encode Module
    Vendor
    Perl
    Product
    Perl
    Vendor
    Redhat
    Product
    Enterprise Linux

    Exploits

    http://perl5.git.perl.org/perl.git/commitdiff/e46d973584785af1f445c4dedbee4243419cb860#patch5http://perl5.git.perl.org/perl.git/commitdiff/e46d973584785af1f445c4dedbee4243419cb860#patch5

    Common Weakness Enumeration

    CWE-122 Heap-based Buffer Overflow

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-92 Forced Integer Overflow

    References

    http://cpansearch.perl.org/src/FLORA/perl-5.14.2/pod/perldelta.pod
    http://perl5.git.perl.org/perl.git/commitdiff/e46d973584785af1f445c4dedbee4243419cb860#patch5
    http://search.cpan.org/~flora/perl-5.14.2/pod/perldelta.pod#Encode_decode_xs_n-byte_heap-overflow_%28CVE-2011-2939%29
    http://secunia.com/advisories/46172
    http://secunia.com/advisories/46989
    http://secunia.com/advisories/51457
    http://secunia.com/advisories/55314
    http://www.mandriva.com/security/advisories?name=MDVSA-2012:008
    http://www.openwall.com/lists/oss-security/2011/08/18/8
    http://www.openwall.com/lists/oss-security/2011/08/19/17
    http://www.redhat.com/support/errata/RHSA-2011-1424.html
    http://www.securityfocus.com/bid/49858
    http://www.ubuntu.com/usn/USN-1643-1
    https://bugzilla.redhat.com/show_bug.cgi?id=731246
    http://cpansearch.perl.org/src/FLORA/perl-5.14.2/pod/perldelta.pod
    http://perl5.git.perl.org/perl.git/commitdiff/e46d973584785af1f445c4dedbee4243419cb860#patch5
    http://search.cpan.org/~flora/perl-5.14.2/pod/perldelta.pod#Encode_decode_xs_n-byte_heap-overflow_%28CVE-2011-2939%29
    http://secunia.com/advisories/46172
    http://secunia.com/advisories/46989
    http://secunia.com/advisories/51457
    http://secunia.com/advisories/55314
    http://www.mandriva.com/security/advisories?name=MDVSA-2012:008
    http://www.openwall.com/lists/oss-security/2011/08/18/8
    http://www.openwall.com/lists/oss-security/2011/08/19/17
    http://www.redhat.com/support/errata/RHSA-2011-1424.html
    http://www.securityfocus.com/bid/49858
    http://www.ubuntu.com/usn/USN-1643-1
    https://bugzilla.redhat.com/show_bug.cgi?id=731246

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High