CVE-2011-2939
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44...
CVE-2011-2939 is a medium vulnerability (CVSS 5.1) in Dan Kogai Encode Module, published January 13, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.56%, the 85th percentile. Fixed in libencode-perl 2.44-1.
- Severity
- 5.1 MediumCVSS 2.0, NVD
- Exploit chance
- 2.56%EPSS, 85th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.44-1libencode-perl +50 more
Description
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libencode-perlDebian:12 | before 2.44-1 | 2.44-1 |
libencode-perlDebian:13 | before 2.44-1 | 2.44-1 |
libencode-perlDebian:14 | before 2.44-1 | 2.44-1 |
perlDebian:12 | before 5.12.4-4 | 5.12.4-4 |
perlDebian:13 | before 5.12.4-4 | 5.12.4-4 |
perlDebian:14 | before 5.12.4-4 | 5.12.4-4 |
perlRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 4:5.10.1-119.el6_1.1 | 4:5.10.1-119.el6_1.1 |
perl-Archive-ExtractRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 1:0.38-119.el6_1.1 | 1:0.38-119.el6_1.1 |
perl-Archive-TarRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:1.58-119.el6_1.1 | 0:1.58-119.el6_1.1 |
perl-CGIRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:3.51-119.el6_1.1 | 0:3.51-119.el6_1.1 |
Show 41 moreShow less
| Package | Affected | Fixed |
|---|---|---|
perl-CPANRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:1.9402-119.el6_1.1 | 0:1.9402-119.el6_1.1 |
perl-CPANPLUSRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:0.88-119.el6_1.1 | 0:0.88-119.el6_1.1 |
perl-Compress-Raw-ZlibRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:2.023-119.el6_1.1 | 0:2.023-119.el6_1.1 |
perl-Compress-ZlibRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:2.020-119.el6_1.1 | 0:2.020-119.el6_1.1 |
perl-Digest-SHARed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 1:5.47-119.el6_1.1 | 1:5.47-119.el6_1.1 |
perl-ExtUtils-CBuilderRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 1:0.27-119.el6_1.1 | 1:0.27-119.el6_1.1 |
perl-ExtUtils-EmbedRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:1.28-119.el6_1.1 | 0:1.28-119.el6_1.1 |
perl-ExtUtils-MakeMakerRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:6.55-119.el6_1.1 | 0:6.55-119.el6_1.1 |
perl-ExtUtils-ParseXSRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 1:2.2003.0-119.el6_1.1 | 1:2.2003.0-119.el6_1.1 |
perl-File-FetchRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:0.26-119.el6_1.1 | 0:0.26-119.el6_1.1 |
perl-IO-Compress-BaseRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:2.020-119.el6_1.1 | 0:2.020-119.el6_1.1 |
perl-IO-Compress-ZlibRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:2.020-119.el6_1.1 | 0:2.020-119.el6_1.1 |
perl-IO-ZlibRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 1:1.09-119.el6_1.1 | 1:1.09-119.el6_1.1 |
perl-IPC-CmdRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 1:0.56-119.el6_1.1 | 1:0.56-119.el6_1.1 |
perl-Locale-Maketext-SimpleRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 1:0.18-119.el6_1.1 | 1:0.18-119.el6_1.1 |
perl-Log-MessageRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 1:0.02-119.el6_1.1 | 1:0.02-119.el6_1.1 |
perl-Log-Message-SimpleRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:0.04-119.el6_1.1 | 0:0.04-119.el6_1.1 |
perl-Module-BuildRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 1:0.3500-119.el6_1.1 | 1:0.3500-119.el6_1.1 |
perl-Module-CoreListRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:2.18-119.el6_1.1 | 0:2.18-119.el6_1.1 |
perl-Module-LoadRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 1:0.16-119.el6_1.1 | 1:0.16-119.el6_1.1 |
perl-Module-Load-ConditionalRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:0.30-119.el6_1.1 | 0:0.30-119.el6_1.1 |
perl-Module-LoadedRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 1:0.02-119.el6_1.1 | 1:0.02-119.el6_1.1 |
perl-Module-PluggableRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 1:3.90-119.el6_1.1 | 1:3.90-119.el6_1.1 |
perl-Object-AccessorRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 1:0.34-119.el6_1.1 | 1:0.34-119.el6_1.1 |
perl-Package-ConstantsRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 1:0.02-119.el6_1.1 | 1:0.02-119.el6_1.1 |
perl-Params-CheckRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 1:0.26-119.el6_1.1 | 1:0.26-119.el6_1.1 |
perl-Parse-CPAN-MetaRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 1:1.40-119.el6_1.1 | 1:1.40-119.el6_1.1 |
perl-Pod-EscapesRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 1:1.04-119.el6_1.1 | 1:1.04-119.el6_1.1 |
perl-Pod-SimpleRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 1:3.13-119.el6_1.1 | 1:3.13-119.el6_1.1 |
perl-Term-UIRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:0.20-119.el6_1.1 | 0:0.20-119.el6_1.1 |
perl-Test-HarnessRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:3.17-119.el6_1.1 | 0:3.17-119.el6_1.1 |
perl-Test-SimpleRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:0.92-119.el6_1.1 | 0:0.92-119.el6_1.1 |
perl-Time-HiResRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 4:1.9721-119.el6_1.1 | 4:1.9721-119.el6_1.1 |
perl-Time-PieceRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:1.15-119.el6_1.1 | 0:1.15-119.el6_1.1 |
perl-coreRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 0:5.10.1-119.el6_1.1 | 0:5.10.1-119.el6_1.1 |
perl-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 4:5.10.1-119.el6_1.1 | 4:5.10.1-119.el6_1.1 |
perl-develRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 4:5.10.1-119.el6_1.1 | 4:5.10.1-119.el6_1.1 |
perl-libsRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 4:5.10.1-119.el6_1.1 | 4:5.10.1-119.el6_1.1 |
perl-parentRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 1:0.221-119.el6_1.1 | 1:0.221-119.el6_1.1 |
perl-suidperlRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 4:5.10.1-119.el6_1.1 | 4:5.10.1-119.el6_1.1 |
perl-versionRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs | before 3:0.77-119.el6_1.1 | 3:0.77-119.el6_1.1 |
What each source reports
NVD Score used
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.
- Record
CVE-2011-2939- CVSS 2.0
- 5.1 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:P - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE ListNo score
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.
- Record
CVE-2011-2939- Updated
- 2026-11-02
EUVDEUVD-2011-2907No score
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.
- Record
EUVD-2011-2907- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-76hr-qp66-cq6jNo score
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44...
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.
- Record
GHSA-76hr-qp66-cq6j- Updated
- 2026-11-02
OSVNo score
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.
- Record
CVE-2011-2939- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-2939No score
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.
- Record
DEBIAN-CVE-2011-2939- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
secunia.com/advisories/46989
cpansearch.perl.org/src/FLORA/perl-5.14.2/pod/perldelta.pod
ubuntu.com/usn/USN-1643-1
securityfocus.com/bid/49858
openwall.com/lists/oss-security/2011/08/18/8
Show 20 moreShow less
perl5.git.perl.org/perl.git/commitdiff/e46d973584785af1f445c4dedbee4243419cb860
bugzilla.redhat.com/show_bug.cgi?id=731246
search.cpan.org/~flora/perl-5.14.2/pod/perldelta.pod
mandriva.com/security/advisories?name=MDVSA-2012:008
redhat.com/support/errata/RHSA-2011-1424.html
nvd.nist.gov/vuln/detail/CVE-2011-2939
access.redhat.com/errata/RHSA-2011:1424
github.com/advisories/GHSA-76hr-qp66-cq6j
security-tracker.debian.org/tracker/CVE-2011-2939
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1424.json
cve.org/CVERecord?id=CVE-2011-2939