CVE-2011-2939
Summary
| CVE | CVE-2011-2939 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2012-01-13 18:55:02 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
HighAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:H/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Dan Kogai | Encode Module | 0.93 | All | All | All |
| Application | Dan Kogai | Encode Module | 0.94 | All | All | All |
| Application | Dan Kogai | Encode Module | 0.95 | All | All | All |
| Application | Dan Kogai | Encode Module | 0.96 | All | All | All |
| Application | Dan Kogai | Encode Module | 0.97 | All | All | All |
| Application | Dan Kogai | Encode Module | 0.98 | All | All | All |
| Application | Dan Kogai | Encode Module | 0.99 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.00 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.01 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.10 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.11 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.20 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.21 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.25 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.26 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.28 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.30 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.31 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.32 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.33 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.34 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.40 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.41 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.42 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.50 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.51 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.52 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.53 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.54 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.55 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.56 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.57 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.58 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.59 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.60 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.61 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.62 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.63 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.64 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.65 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.66 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.67 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.68 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.69 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.70 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.71 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.72 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.73 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.74 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.75 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.76 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.77 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.78 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.79 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.80 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.81 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.82 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.83 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.84 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.85 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.86 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.87 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.88 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.89 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.90 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.91 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.92 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.93 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.94 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.95 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.96 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.97 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.98 | All | All | All |
| Application | Dan Kogai | Encode Module | 1.99 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.0 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.01 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.02 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.03 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.04 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.05 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.06 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.07 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.08 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.09 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.10 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.11 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.12 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.13 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.14 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.15 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.16 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.17 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.18 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.19 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.20 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.21 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.22 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.23 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.24 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.25 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.26 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.27 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.28 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.29 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.30 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.31 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.32 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.33 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.34 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.35 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.36 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.37 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.38 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.39 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.40 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.41 | All | All | All |
| Application | Dan Kogai | Encode Module | 2.42 | All | All | All |
| Application | Dan Kogai | Encode Module | All | All | All | All |
| Application | Perl | Perl | 5.10 | All | All | All |
| Application | Perl | Perl | 5.10.0 | All | All | All |
| Application | Perl | Perl | 5.10.0 | rc1 | All | All |
| Application | Perl | Perl | 5.10.0 | rc2 | All | All |
| Application | Perl | Perl | 5.10.1 | All | All | All |
| Application | Perl | Perl | 5.10.1 | rc1 | All | All |
| Application | Perl | Perl | 5.10.1 | rc2 | All | All |
| Application | Perl | Perl | 5.11.0 | All | All | All |
| Application | Perl | Perl | 5.11.1 | All | All | All |
| Application | Perl | Perl | 5.11.2 | All | All | All |
| Application | Perl | Perl | 5.11.3 | All | All | All |
| Application | Perl | Perl | 5.11.4 | All | All | All |
| Application | Perl | Perl | 5.11.5 | All | All | All |
| Application | Perl | Perl | 5.12.0 | All | All | All |
| Application | Perl | Perl | 5.12.0 | rc0 | All | All |
| Application | Perl | Perl | 5.12.0 | rc1 | All | All |
| Application | Perl | Perl | 5.12.0 | rc2 | All | All |
| Application | Perl | Perl | 5.12.0 | rc3 | All | All |
| Application | Perl | Perl | 5.12.0 | rc4 | All | All |
| Application | Perl | Perl | 5.12.0 | rc5 | All | All |
| Application | Perl | Perl | 5.12.1 | All | All | All |
| Application | Perl | Perl | 5.12.1 | rc1 | All | All |
| Application | Perl | Perl | 5.12.1 | rc2 | All | All |
| Application | Perl | Perl | 5.12.2 | All | All | All |
| Application | Perl | Perl | 5.12.2 | rc1 | All | All |
| Application | Perl | Perl | 5.12.3 | All | All | All |
| Application | Perl | Perl | 5.12.3 | rc1 | All | All |
| Application | Perl | Perl | 5.12.3 | rc2 | All | All |
| Application | Perl | Perl | 5.12.3 | rc3 | All | All |
| Application | Perl | Perl | 5.13.0 | All | All | All |
| Application | Perl | Perl | 5.13.1 | All | All | All |
| Application | Perl | Perl | 5.13.10 | All | All | All |
| Application | Perl | Perl | 5.13.11 | All | All | All |
| Application | Perl | Perl | 5.13.2 | All | All | All |
| Application | Perl | Perl | 5.13.3 | All | All | All |
| Application | Perl | Perl | 5.13.4 | All | All | All |
| Application | Perl | Perl | 5.13.5 | All | All | All |
| Application | Perl | Perl | 5.13.6 | All | All | All |
| Application | Perl | Perl | 5.13.7 | All | All | All |
| Application | Perl | Perl | 5.13.8 | All | All | All |
| Application | Perl | Perl | 5.13.9 | All | All | All |
| Application | Perl | Perl | 5.14.0 | All | All | All |
| Application | Perl | Perl | 5.14.0 | rc1 | All | All |
| Application | Perl | Perl | 5.14.0 | rc2 | All | All |
| Application | Perl | Perl | 5.14.0 | rc3 | All | All |
| Application | Perl | Perl | 5.14.1 | All | All | All |
| Application | Perl | Perl | 5.8.1 | All | All | All |
| Application | Perl | Perl | 5.8.10 | All | All | All |
| Application | Perl | Perl | 5.8.2 | All | All | All |
| Application | Perl | Perl | 5.8.3 | All | All | All |
| Application | Perl | Perl | 5.8.4 | All | All | All |
| Application | Perl | Perl | 5.8.5 | All | All | All |
| Application | Perl | Perl | 5.8.6 | All | All | All |
| Application | Perl | Perl | 5.8.7 | All | All | All |
| Application | Perl | Perl | 5.8.8 | All | All | All |
| Application | Perl | Perl | 5.8.9 | All | All | All |
| Application | Perl | Perl | 5.9.2 | All | All | All |
| Application | Perl | Perl | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Support / Security / Advisories / / MDVSA-2012:008 | Mandriva | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| cpansearch.perl.org/src/FLORA/perl-5.14.2/pod/perldelta.pod | af854a3a-2127-422b-91ae-364da2661108 | cpansearch.perl.org | |
| Perl 'decode_xs()' and 'File::Glob::bsd_glob()' Remote Code Execution Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| Security Alerts - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| About Secunia Research | Flexera | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Perl "decode_xs()" and "File::Glob::bsd_glob()" Vulnerabilities - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| oss-security - CVE request: heap overflow in perl while decoding Unicode string | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| oss-security - Re: CVE request: heap overflow in perl while decoding Unicode string | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | Patch |
| USN-1643-1: Perl vulnerabilities | Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | www.ubuntu.com | |
| perldelta - search.cpan.org | af854a3a-2127-422b-91ae-364da2661108 | search.cpan.org | |
| perl5.git.perl.org Git - perl.git/commitdiff | af854a3a-2127-422b-91ae-364da2661108 | perl5.git.perl.org | Exploit, Patch |
| Bug 731246 – CVE-2011-2939 Perl decode_xs heap-based buffer overflow | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Patch |
| Security Advisory SA55314 - Oracle Solaris Perl Multiple Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| perldelta - search.cpan.org | MITRE | search.cpan.org | |
| Red Hat Customer Portal | MITRE | access.redhat.com | |
| CVE-2011-2939 - Red Hat Customer Portal | MITRE | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.