{"id":"CVE-2009-1391","aliases":["DEBIAN-CVE-2009-1391","EUVD-2009-1389","GHSA-353f-jcfv-fpmh"],"status":"published","title":"Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2...","description":"Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service (hang or crash) via a crafted zlib compressed stream that triggers a heap-based buffer overflow, as exploited in the wild by Trojan.Downloader-71014 in June 2009.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.07441,"percentile":0.94496,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-189"],"published":"2009-06-16T23:00:00Z","modified":"2026-10-23T17:47:32Z","exploits":[{"source":"exploitdb","id":"EDB-33032","title":"Compress::Raw::Zlib Perl Module - Remote Code Execution","type":"remote","platform":"linux","date":"2009-05-11","verified":true,"url":"https://www.exploit-db.com/exploits/33032"}],"fixes":[{"ecosystem":"Debian:12","package":"libcompress-raw-zlib-perl","fixed_in":["2.015-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libcompress-raw-zlib-perl","fixed_in":["2.015-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libcompress-raw-zlib-perl","fixed_in":["2.015-2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"perl","fixed_in":["5.10.0-23"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"perl","fixed_in":["5.10.0-23"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"perl","fixed_in":["5.10.0-23"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libcompress-raw-zlib-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.015-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libcompress-raw-zlib-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.015-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libcompress-raw-zlib-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.015-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-23"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-23"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-23"}]}]}],"products":[{"vendor":"paul_marquess","product":"compress-raw-zlib_perl_module"}],"references":[{"url":"http://article.gmane.org/gmane.mail.virus.amavis.user/33635","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://thread.gmane.org/gmane.mail.virus.amavis.user/33635","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/51062","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"https://usn.ubuntu.com/794-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2009:157","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"https://bugs.gentoo.org/show_bug.cgi?id=273141","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/35307","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit","Patch","evidence","fix"]},{"url":"http://security.gentoo.org/glsa/glsa-200908-07.xml","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/35685","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=504386","tags":["x_refsource_CONFIRM","x_transferred","Exploit","evidence"]},{"url":"http://secunia.com/advisories/35689","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.vupen.com/english/advisories/2009/1571","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://osvdb.org/55041","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"http://article.gmane.org/gmane.mail.virus.amavis.user/33638","tags":["x_refsource_MISC","x_transferred","Exploit","evidence"]},{"url":"http://secunia.com/advisories/35422","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://secunia.com/advisories/35876","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00607.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1391"},{"url":"https://usn.ubuntu.com/794-1"},{"url":"https://github.com/advisories/GHSA-353f-jcfv-fpmh"},{"url":"https://security-tracker.debian.org/tracker/CVE-2009-1391","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2009-1391","description":"Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service (hang or crash) via a crafted zlib compressed stream that triggers a heap-based buffer overflow, as exploited in the wild by Trojan.Downloader-71014 in June 2009.","status":"published","published":"2009-06-16T23:00:00Z","modified":"2024-08-07T05:13:25.381Z","updated_at":"2026-11-02T14:33:25.126493Z"}],"euvd":[{"id":"EUVD-2009-1389","description":"Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service (hang or crash) via a crafted zlib compressed stream that triggers a heap-based buffer overflow, as exploited in the wild by Trojan.Downloader-71014 in June 2009.","status":"published","published":"2009-06-16T23:00:00Z","modified":"2024-08-07T05:13:25Z","updated_at":"2026-11-03T01:39:21.866798Z"}],"ghsa":[{"id":"GHSA-353f-jcfv-fpmh","title":"Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2...","description":"Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service (hang or crash) via a crafted zlib compressed stream that triggers a heap-based buffer overflow, as exploited in the wild by Trojan.Downloader-71014 in June 2009.","status":"published","published":"2022-05-02T03:24:38Z","modified":"2025-04-09T04:12:11Z","updated_at":"2026-11-02T15:01:00.53445Z"}],"nvd":[{"id":"CVE-2009-1391","description":"Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service (hang or crash) via a crafted zlib compressed stream that triggers a heap-based buffer overflow, as exploited in the wild by Trojan.Downloader-71014 in June 2009.","status":"published","published":"2009-06-16T23:30:00.203Z","modified":"2026-06-16T23:07:11.35Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-189"],"updated_at":"2026-11-02T14:01:35.733785Z"}],"osv":[{"id":"CVE-2009-1391","description":"Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service (hang or crash) via a crafted zlib compressed stream that triggers a heap-based buffer overflow, as exploited in the wild by Trojan.Downloader-71014 in June 2009.","status":"published","published":"2009-06-16T23:30:00Z","modified":"2026-04-10T03:40:45.348167Z","updated_at":"2026-11-02T15:43:57.452479Z"},{"id":"DEBIAN-CVE-2009-1391","description":"Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service (hang or crash) via a crafted zlib compressed stream that triggers a heap-based buffer overflow, as exploited in the wild by Trojan.Downloader-71014 in June 2009.","status":"published","published":"2009-06-16T23:30:00.203Z","modified":"2026-10-23T17:47:32.468947154Z","updated_at":"2026-11-02T15:45:24.013654Z"}]}}