PT-2012-1219 · Perl+1 · Perl+2

Petr Pisar + 1 · Published 2011-11-03 · Updated 2023-02-13 · CVE-2011-2939

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Encode module versions prior to 2.44 Perl versions prior to 5.15.6

Description The issue is related to an off-by-one error in the decode xs function, which can lead to a denial of service due to memory corruption. This is caused by a heap-based buffer overflow when processing a crafted Unicode string. The vulnerability is associated with errors in number processing and can be exploited by a remote attacker to cause a denial of service.

Recommendations For Encode module versions prior to 2.44, update to version 2.44 or later. For Perl versions prior to 5.15.6, update to version 5.15.6 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

BDU:2022-02611

CVE-2011-2939

RHSA-2011:1424

RHSA-2011_1424

Affected Products

Encode

Perl

Red Hat

References · 25

• 🔥 http://perl5.git.perl.org/perl.git/commitdiff/e46d973584785af1f445c4dedbee4243419cb860#patch5 · Exploit
• https://bdu.fstec.ru/vul/2022-02611 · Security Note
• http://openwall.com/lists/oss-security/2011/08/19/17 · Patch
• https://osv.dev/vulnerability/CVE-2011-2939 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-1424.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2012:008 · Vendor Advisory
• http://ubuntu.com/usn/USN-1643-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-2939 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-2939 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=731246 · Patch
• https://linux.oracle.com/errata/ELSA-2011-1424.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-2939 · Vendor Advisory
• http://secunia.com/advisories/51457 · Note
• http://secunia.com/advisories/46172 · Note
• http://securityfocus.com/bid/49858 · Note