CVE-2005-3962
Integer overflow in the format string functionality (Perl_sv_vcatpvfn) in Perl 5.9.2 and 5.8.6 Perl allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via format string
02 Description
Integer overflow in the format string functionality (Perl_sv_vcatpvfn) in Perl 5.9.2 and 5.8.6 Perl allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via format string
03 Exploitation and scoring
- Exploitation
- Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
- SSVC decision
- Not assessed by CISA
- EPSS probability
- 1.37% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 71.7% of scored records. A rank, not a probability.
- NVD base score
- The NVD has published no score for this record
- NVD CVSS vector
- No NVD score to derive
- NVD analysis status
- Modified. NVD last modified this record on 2026-06-16.
- Red Hat severity
- Moderate. Red Hat's rating for its own products, not a CVSS rating.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2005-12-01 17:00Z20 YR AGO
- Last updated
- 2024-08-07 23:31Z2 YR AGO
- Reserved
- 2005-12-01
- Assigning CNA
- redhat
- Record state
- PUBLISHED
- Severity
- Not rated by the issuing CNA
- CNA CVSS vector
- Not published by the issuing CNA
- Weaknesses
- Data version
- 5.1
- Document digest
- 4f2c5de17ecf40c0bc9b7543c0da3156aa4d6f87087ca44b1a7f0ebd9c8dbecf
05 Affected products
06 References
- www.vupen.comADV-2006-4750http://www.vupen.com/english/advisories/2006/4750
- oval.cisecurity.orgoval:org.mitre.oval:def:1074https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1074
- www.kb.cert.orgVU#948385http://www.kb.cert.org/vuls/id/948385
- www.osvdb.org22255http://www.osvdb.org/22255
- secunia.com17941http://secunia.com/advisories/17941
- support.avaya.comhttp://support.avaya.com/elmodocs2/security/ASA-2006-081.htm
- www.securityfocus.com20051201 Perl format string integer wrap vulnerabilityhttp://www.securityfocus.com/archive/1/418333/100/0/threaded
- www.securityfocus.comHPSBTU02125http://www.securityfocus.com/archive/1/438726/100/0/threaded
- marc.info20051201 Perl format string integer wrap vulnerabilityhttp://marc.info/?l=full-disclosure&m=113342788118630&w=2
- www.vupen.comADV-2005-2688http://www.vupen.com/english/advisories/2005/2688
- www.dyadsecurity.comhttp://www.dyadsecurity.com/perl-0002.html
- www.osvdb.org21345http://www.osvdb.org/21345
- www.securityfocus.com15629http://www.securityfocus.com/bid/15629
- www.redhat.comRHSA-2005:881http://www.redhat.com/support/errata/RHSA-2005-881.html
- docs.info.apple.comhttp://docs.info.apple.com/article.html?artnum=304829
- oval.cisecurity.orgoval:org.mitre.oval:def:10598https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10598
- www.debian.orgDSA-943http://www.debian.org/security/2006/dsa-943
- www.openbsd.org[3.7] 20060105 007: SECURITY FIX: January 5, 2006http://www.openbsd.org/errata37.html#perl
- secunia.com17993http://secunia.com/advisories/17993
- secunia.com18075http://secunia.com/advisories/18075
- www.redhat.comFLSA-2006:176731https://www.redhat.com/archives/fedora-legacy-announce/2006-February/msg00008.html
- distro.conectiva.com.brCLSA-2006:1056http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=001056
- www.openpkg.orgOpenPKG-SA-2005.025http://www.openpkg.org/security/OpenPKG-SA-2005.025-perl.html
- www.vupen.comADV-2006-0771http://www.vupen.com/english/advisories/2006/0771
- patches.sgi.com20060101-01-Uftp://patches.sgi.com/support/free/security/advisories/20060101-01-U
- secunia.com20894http://secunia.com/advisories/20894
- usn.ubuntu.comUSN-222-1https://usn.ubuntu.com/222-1/
- www.vupen.comADV-2006-2613http://www.vupen.com/english/advisories/2006/2613
- secunia.com18413http://secunia.com/advisories/18413
- secunia.com23155http://secunia.com/advisories/23155
- secunia.com17762http://secunia.com/advisories/17762
- secunia.com18187http://secunia.com/advisories/18187
- www.trustix.orgTSLSA-2005-0070http://www.trustix.org/errata/2005/0070
- secunia.com18517http://secunia.com/advisories/18517
- secunia.com18295http://secunia.com/advisories/18295
- www.novell.comSUSE-SA:2005:071http://www.novell.com/linux/security/advisories/2005_71_perl.html
- secunia.com18183http://secunia.com/advisories/18183
- www.redhat.comRHSA-2005:880http://www.redhat.com/support/errata/RHSA-2005-880.html
- ftp.openbsd.orgftp://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/001_perl.patch
- lists.apple.comAPPLE-SA-2006-11-28http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html
- www.us-cert.govTA06-333Ahttp://www.us-cert.gov/cas/techalerts/TA06-333A.html
- sunsolve.sun.com102192http://sunsolve.sun.com/search/document.do?assetkey=1-26-102192-1
- secunia.com17952http://secunia.com/advisories/17952
- www.mandriva.comMDKSA-2005:225http://www.mandriva.com/security/advisories?name=MDKSA-2005:225
- www.ipcop.orghttp://www.ipcop.org/index.php?name=News&file=article&sid=41
- ftp.openbsd.orgftp://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/007_perl.patch
- www.gentoo.orgGLSA-200512-01http://www.gentoo.org/security/en/glsa/glsa-200512-01.xml
- secunia.com31208http://secunia.com/advisories/31208
- secunia.com17802http://secunia.com/advisories/17802
- www.novell.comSUSE-SR:2005:029http://www.novell.com/linux/security/advisories/2005_29_sr.html
- secunia.com19041http://secunia.com/advisories/19041
- secunia.com17844http://secunia.com/advisories/17844
07 Fixed in
Debian 12
- perl Fixed in 5.8.7-9
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 13
- perl Fixed in 5.8.7-9
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 14
- perl Fixed in 5.8.7-9
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.