CVE-2005-3962
Integer overflow in the format string functionality (Perl_sv_vcatpvfn) in Perl 5.9.2 and 5.8.6 Perl allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via format string specifiers with large values, which causes an…
Does this matter?
Lower severity and a low EPSS score (1.37%). Track it; it rarely justifies an emergency change on its own.
Description
Integer overflow in the format string functionality (Perl_sv_vcatpvfn) in Perl 5.9.2 and 5.8.6 Perl allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via format string specifiers with large values, which causes an integer wrap and leads to a buffer overflow, as demonstrated using format string vulnerabilities in Perl applications.
- CVSS 2.0
- 4.6 MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 1.37% probability · 70th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-189
- Affected
- perl/perl
- Source
- secalert@redhat.com
References
- ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/007_perl.patch
- ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/001_perl.patch
- ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=001056
- http://docs.info.apple.com/article.html?artnum=304829
- http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html
- http://marc.info/?l=full-disclosure&m=113342788118630&w=2
- http://secunia.com/advisories/17762Vendor Advisory
- http://secunia.com/advisories/17802Vendor Advisory
- http://secunia.com/advisories/17844Vendor Advisory
- http://secunia.com/advisories/17941Vendor Advisory
- http://secunia.com/advisories/17952Vendor Advisory
- http://secunia.com/advisories/17993Vendor Advisory
- http://secunia.com/advisories/18075Vendor Advisory
- http://secunia.com/advisories/18183Vendor Advisory
- http://secunia.com/advisories/18187Vendor Advisory
- http://secunia.com/advisories/18295Vendor Advisory
- http://secunia.com/advisories/18413Vendor Advisory
- http://secunia.com/advisories/18517Vendor Advisory
- http://secunia.com/advisories/19041Vendor Advisory
- http://secunia.com/advisories/20894Vendor Advisory
- http://secunia.com/advisories/23155Vendor Advisory
- http://secunia.com/advisories/31208Vendor Advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102192-1
- http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm
- http://www.debian.org/security/2006/dsa-943
- http://www.dyadsecurity.com/perl-0002.htmlPatch, Vendor Advisory
- http://www.gentoo.org/security/en/glsa/glsa-200512-01.xml
- http://www.ipcop.org/index.php?name=News&file=article&sid=41
- http://www.kb.cert.org/vuls/id/948385US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.