CVE-2009-1391
Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2...
Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service (hang or crash) via a crafted zlib compressed stream that triggers a heap-based buffer overflow, as exploited in the wild by Trojan.Downloader-71014 in June 2009.
Exploit likelihood
What each source reports
NVD Score used
Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service (hang or crash) via a crafted zlib compressed stream that triggers a heap-based buffer overflow, as exploited in the wild by Trojan.Downloader-71014 in June 2009.
- Record
CVE-2009-1391- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service (hang or crash) via a crafted zlib compressed stream that triggers a heap-based buffer overflow, as exploited in the wild by Trojan.Downloader-71014 in June 2009.
- Record
CVE-2009-1391- Updated
- 2026-11-02
EUVDEUVD-2009-1389 No score
Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service (hang or crash) via a crafted zlib compressed stream that triggers a heap-based buffer overflow, as exploited in the wild by Trojan.Downloader-71014 in June 2009.
- Record
EUVD-2009-1389- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-353f-jcfv-fpmh No score
Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2...
Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service (hang or crash) via a crafted zlib compressed stream that triggers a heap-based buffer overflow, as exploited in the wild by Trojan.Downloader-71014 in June 2009.
- Record
GHSA-353f-jcfv-fpmh- Updated
- 2026-11-02
OSV No score
Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service (hang or crash) via a crafted zlib compressed stream that triggers a heap-based buffer overflow, as exploited in the wild by Trojan.Downloader-71014 in June 2009.
- Record
CVE-2009-1391- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-1391 No score
Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service (hang or crash) via a crafted zlib compressed stream that triggers a heap-based buffer overflow, as exploited in the wild by Trojan.Downloader-71014 in June 2009.
- Record
DEBIAN-CVE-2009-1391- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libcompress-raw-zlib-perlDebian:12 |
before 2.015-2 | 2.015-2 |
libcompress-raw-zlib-perlDebian:13 |
before 2.015-2 | 2.015-2 |
libcompress-raw-zlib-perlDebian:14 |
before 2.015-2 | 2.015-2 |
perlDebian:12 |
before 5.10.0-23 | 5.10.0-23 |
perlDebian:13 |
before 5.10.0-23 | 5.10.0-23 |
perlDebian:14 |
before 5.10.0-23 | 5.10.0-23 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Compress::Raw::Zlib Perl Module - Remote Code Execution | 2009-05-11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-1391 is a medium vulnerability (CVSS 6.8) in Paul Marquess Compress-raw-zlib Perl Module, published June 16, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 7.44%, the 94th percentile. Fixed in libcompress-raw-zlib-perl 2.015-2.
References
article.gmane.org/gmane.mail.virus.amavis.user/33635
thread.gmane.org/gmane.mail.virus.amavis.user/33635
exchange.xforce.ibmcloud.com/vulnerabilities/51062
usn.ubuntu.com/794-1
mandriva.com/security/advisories?name=MDVSA-2009:157
bugs.gentoo.org/show_bug.cgi?id=273141
Show 15 moreShow less
securityfocus.com/bid/35307
security.gentoo.org/glsa/glsa-200908-07.xml
secunia.com/advisories/35685
bugzilla.redhat.com/show_bug.cgi?id=504386
vupen.com/english/advisories/2009/1571
lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html
osvdb.org/55041
redhat.com/archives/fedora-package-announce/2009-July/msg00607.html
nvd.nist.gov/vuln/detail/CVE-2009-1391
github.com/advisories/GHSA-353f-jcfv-fpmh
security-tracker.debian.org/tracker/CVE-2009-1391