CVE-2011-2939
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44...
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.
Exploit likelihood
What each source reports
NVD Score used
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.
- Record
CVE-2011-2939- CVSS 2.0
- 5.1 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:P - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.
- Record
CVE-2011-2939- Updated
- 2026-11-02
EUVDEUVD-2011-2907 No score
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.
- Record
EUVD-2011-2907- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-76hr-qp66-cq6j No score
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44...
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.
- Record
GHSA-76hr-qp66-cq6j- Updated
- 2026-11-02
OSV No score
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.
- Record
CVE-2011-2939- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-2939 No score
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.
- Record
DEBIAN-CVE-2011-2939- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libencode-perlDebian:12 |
before 2.44-1 | 2.44-1 |
libencode-perlDebian:13 |
before 2.44-1 | 2.44-1 |
libencode-perlDebian:14 |
before 2.44-1 | 2.44-1 |
perlDebian:12 |
before 5.12.4-4 | 5.12.4-4 |
perlDebian:13 |
before 5.12.4-4 | 5.12.4-4 |
perlDebian:14 |
before 5.12.4-4 | 5.12.4-4 |
perlRed Hat:enterprise_linux:6::server |
before 4:5.10.1-119.el6_1.1 | 4:5.10.1-119.el6_1.1 |
perl-Archive-ExtractRed Hat:enterprise_linux:6::server |
before 1:0.38-119.el6_1.1 | 1:0.38-119.el6_1.1 |
perl-Archive-TarRed Hat:enterprise_linux:6::server |
before 0:1.58-119.el6_1.1 | 0:1.58-119.el6_1.1 |
perl-CGIRed Hat:enterprise_linux:6::server |
before 0:3.51-119.el6_1.1 | 0:3.51-119.el6_1.1 |
Show 41 moreShow less
| Package | Affected | Fixed |
|---|---|---|
perl-CPANRed Hat:enterprise_linux:6::server |
before 0:1.9402-119.el6_1.1 | 0:1.9402-119.el6_1.1 |
perl-CPANPLUSRed Hat:enterprise_linux:6::server |
before 0:0.88-119.el6_1.1 | 0:0.88-119.el6_1.1 |
perl-Compress-Raw-ZlibRed Hat:enterprise_linux:6::server |
before 0:2.023-119.el6_1.1 | 0:2.023-119.el6_1.1 |
perl-Compress-ZlibRed Hat:enterprise_linux:6::server |
before 0:2.020-119.el6_1.1 | 0:2.020-119.el6_1.1 |
perl-Digest-SHARed Hat:enterprise_linux:6::server |
before 1:5.47-119.el6_1.1 | 1:5.47-119.el6_1.1 |
perl-ExtUtils-CBuilderRed Hat:enterprise_linux:6::server |
before 1:0.27-119.el6_1.1 | 1:0.27-119.el6_1.1 |
perl-ExtUtils-EmbedRed Hat:enterprise_linux:6::server |
before 0:1.28-119.el6_1.1 | 0:1.28-119.el6_1.1 |
perl-ExtUtils-MakeMakerRed Hat:enterprise_linux:6::server |
before 0:6.55-119.el6_1.1 | 0:6.55-119.el6_1.1 |
perl-ExtUtils-ParseXSRed Hat:enterprise_linux:6::server |
before 1:2.2003.0-119.el6_1.1 | 1:2.2003.0-119.el6_1.1 |
perl-File-FetchRed Hat:enterprise_linux:6::server |
before 0:0.26-119.el6_1.1 | 0:0.26-119.el6_1.1 |
perl-IO-Compress-BaseRed Hat:enterprise_linux:6::server |
before 0:2.020-119.el6_1.1 | 0:2.020-119.el6_1.1 |
perl-IO-Compress-ZlibRed Hat:enterprise_linux:6::server |
before 0:2.020-119.el6_1.1 | 0:2.020-119.el6_1.1 |
perl-IO-ZlibRed Hat:enterprise_linux:6::server |
before 1:1.09-119.el6_1.1 | 1:1.09-119.el6_1.1 |
perl-IPC-CmdRed Hat:enterprise_linux:6::server |
before 1:0.56-119.el6_1.1 | 1:0.56-119.el6_1.1 |
perl-Locale-Maketext-SimpleRed Hat:enterprise_linux:6::server |
before 1:0.18-119.el6_1.1 | 1:0.18-119.el6_1.1 |
perl-Log-MessageRed Hat:enterprise_linux:6::server |
before 1:0.02-119.el6_1.1 | 1:0.02-119.el6_1.1 |
perl-Log-Message-SimpleRed Hat:enterprise_linux:6::server |
before 0:0.04-119.el6_1.1 | 0:0.04-119.el6_1.1 |
perl-Module-BuildRed Hat:enterprise_linux:6::server |
before 1:0.3500-119.el6_1.1 | 1:0.3500-119.el6_1.1 |
perl-Module-CoreListRed Hat:enterprise_linux:6::server |
before 0:2.18-119.el6_1.1 | 0:2.18-119.el6_1.1 |
perl-Module-LoadRed Hat:enterprise_linux:6::server |
before 1:0.16-119.el6_1.1 | 1:0.16-119.el6_1.1 |
perl-Module-Load-ConditionalRed Hat:enterprise_linux:6::server |
before 0:0.30-119.el6_1.1 | 0:0.30-119.el6_1.1 |
perl-Module-LoadedRed Hat:enterprise_linux:6::server |
before 1:0.02-119.el6_1.1 | 1:0.02-119.el6_1.1 |
perl-Module-PluggableRed Hat:enterprise_linux:6::server |
before 1:3.90-119.el6_1.1 | 1:3.90-119.el6_1.1 |
perl-Object-AccessorRed Hat:enterprise_linux:6::server |
before 1:0.34-119.el6_1.1 | 1:0.34-119.el6_1.1 |
perl-Package-ConstantsRed Hat:enterprise_linux:6::server |
before 1:0.02-119.el6_1.1 | 1:0.02-119.el6_1.1 |
perl-Params-CheckRed Hat:enterprise_linux:6::server |
before 1:0.26-119.el6_1.1 | 1:0.26-119.el6_1.1 |
perl-Parse-CPAN-MetaRed Hat:enterprise_linux:6::server |
before 1:1.40-119.el6_1.1 | 1:1.40-119.el6_1.1 |
perl-Pod-EscapesRed Hat:enterprise_linux:6::server |
before 1:1.04-119.el6_1.1 | 1:1.04-119.el6_1.1 |
perl-Pod-SimpleRed Hat:enterprise_linux:6::server |
before 1:3.13-119.el6_1.1 | 1:3.13-119.el6_1.1 |
perl-Term-UIRed Hat:enterprise_linux:6::server |
before 0:0.20-119.el6_1.1 | 0:0.20-119.el6_1.1 |
perl-Test-HarnessRed Hat:enterprise_linux:6::server |
before 0:3.17-119.el6_1.1 | 0:3.17-119.el6_1.1 |
perl-Test-SimpleRed Hat:enterprise_linux:6::server |
before 0:0.92-119.el6_1.1 | 0:0.92-119.el6_1.1 |
perl-Time-HiResRed Hat:enterprise_linux:6::server |
before 4:1.9721-119.el6_1.1 | 4:1.9721-119.el6_1.1 |
perl-Time-PieceRed Hat:enterprise_linux:6::server |
before 0:1.15-119.el6_1.1 | 0:1.15-119.el6_1.1 |
perl-coreRed Hat:enterprise_linux:6::server |
before 0:5.10.1-119.el6_1.1 | 0:5.10.1-119.el6_1.1 |
perl-debuginfoRed Hat:enterprise_linux:6::server |
before 4:5.10.1-119.el6_1.1 | 4:5.10.1-119.el6_1.1 |
perl-develRed Hat:enterprise_linux:6::server |
before 4:5.10.1-119.el6_1.1 | 4:5.10.1-119.el6_1.1 |
perl-libsRed Hat:enterprise_linux:6::server |
before 4:5.10.1-119.el6_1.1 | 4:5.10.1-119.el6_1.1 |
perl-parentRed Hat:enterprise_linux:6::server |
before 1:0.221-119.el6_1.1 | 1:0.221-119.el6_1.1 |
perl-suidperlRed Hat:enterprise_linux:6::server |
before 4:5.10.1-119.el6_1.1 | 4:5.10.1-119.el6_1.1 |
perl-versionRed Hat:enterprise_linux:6::server |
before 3:0.77-119.el6_1.1 | 3:0.77-119.el6_1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-2939 is a medium vulnerability (CVSS 5.1) in Dan Kogai Encode Module, published January 13, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.56%, the 85th percentile. Fixed in libencode-perl 2.44-1.
References
secunia.com/advisories/46989
cpansearch.perl.org/src/FLORA/perl-5.14.2/pod/perldelta.pod
ubuntu.com/usn/USN-1643-1
securityfocus.com/bid/49858
openwall.com/lists/oss-security/2011/08/18/8
Show 20 moreShow less
perl5.git.perl.org/perl.git/commitdiff/e46d973584785af1f445c4dedbee4243419cb860
bugzilla.redhat.com/show_bug.cgi?id=731246
search.cpan.org/~flora/perl-5.14.2/pod/perldelta.pod
mandriva.com/security/advisories?name=MDVSA-2012:008
redhat.com/support/errata/RHSA-2011-1424.html
nvd.nist.gov/vuln/detail/CVE-2011-2939
access.redhat.com/errata/RHSA-2011:1424
github.com/advisories/GHSA-76hr-qp66-cq6j
security-tracker.debian.org/tracker/CVE-2011-2939
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1424.json
cve.org/CVERecord?id=CVE-2011-2939