{"id":"CVE-2011-2939","aliases":["DEBIAN-CVE-2011-2939","EUVD-2011-2907","GHSA-76hr-qp66-cq6j","RHSA-2011:1424"],"status":"published","title":"Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44...","description":"Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.","severity":{"version":"2.0","score":5.1,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02557,"percentile":0.85183,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-189"],"published":"2012-01-13T18:00:00Z","modified":"2026-10-23T17:47:39Z","fixes":[{"ecosystem":"Debian:12","package":"libencode-perl","fixed_in":["2.44-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libencode-perl","fixed_in":["2.44-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libencode-perl","fixed_in":["2.44-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"perl","fixed_in":["5.12.4-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"perl","fixed_in":["5.12.4-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"perl","fixed_in":["5.12.4-4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libencode-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libencode-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libencode-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.4-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.4-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.4-4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.10.1-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-Archive-Extract","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.38-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-Archive-Tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.58-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-CGI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.51-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-CPAN","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9402-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-CPANPLUS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.88-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-Compress-Raw-Zlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.023-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-Compress-Zlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.020-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-Digest-SHA","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.47-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-ExtUtils-CBuilder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.27-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-ExtUtils-Embed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.28-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-ExtUtils-MakeMaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.55-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-ExtUtils-ParseXS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2003.0-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-File-Fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.26-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-IO-Compress-Base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.020-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-IO-Compress-Zlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.020-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-IO-Zlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.09-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-IPC-Cmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.56-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-Locale-Maketext-Simple","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.18-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-Log-Message","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.02-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-Log-Message-Simple","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.04-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-Module-Build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.3500-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-Module-CoreList","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.18-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-Module-Load","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.16-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-Module-Load-Conditional","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.30-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-Module-Loaded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.02-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-Module-Pluggable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.90-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-Object-Accessor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.34-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-Package-Constants","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.02-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-Params-Check","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.26-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-Parse-CPAN-Meta","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.40-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-Pod-Escapes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.04-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-Pod-Simple","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.13-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-Term-UI","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.20-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-Test-Harness","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.17-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-Test-Simple","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.92-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-Time-HiRes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:1.9721-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-Time-Piece","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.1-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.10.1-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.10.1-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.10.1-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.221-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-suidperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.10.1-119.el6_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"perl-version","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:0.77-119.el6_1.1"}]}],"bundled":2}],"products":[{"vendor":"dan_kogai","product":"encode_module"},{"vendor":"perl","product":"perl"}],"references":[{"url":"http://secunia.com/advisories/46989","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://cpansearch.perl.org/src/FLORA/perl-5.14.2/pod/perldelta.pod","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/55314","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-1643-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/49858","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2011/08/18/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://perl5.git.perl.org/perl.git/commitdiff/e46d973584785af1f445c4dedbee4243419cb860#patch5","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","evidence","fix"]},{"url":"http://secunia.com/advisories/46172","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=731246","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","report"]},{"url":"http://search.cpan.org/~flora/perl-5.14.2/pod/perldelta.pod#Encode_decode_xs_n-byte_heap-overflow_%28CVE-2011-2939%29","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2012:008","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://www.redhat.com/support/errata/RHSA-2011-1424.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2011/08/19/17","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","fix"]},{"url":"http://secunia.com/advisories/51457","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2939","tags":["advisory"]},{"url":"http://search.cpan.org/~flora/perl-5.14.2/pod/perldelta.pod#Encode_decode_xs_n-byte_heap-overflow_(CVE-2011-2939)"},{"url":"https://access.redhat.com/errata/RHSA-2011:1424","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-2939","tags":["report"]},{"url":"https://github.com/advisories/GHSA-76hr-qp66-cq6j"},{"url":"https://security-tracker.debian.org/tracker/CVE-2011-2939","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=743010","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1424.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-2939","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-3597","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-3597","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-3597","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2011-2939","description":"Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.","status":"published","published":"2012-01-13T18:00:00Z","modified":"2024-08-06T23:15:31.951Z","updated_at":"2026-11-02T14:35:36.603688Z"}],"euvd":[{"id":"EUVD-2011-2907","description":"Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.","status":"published","published":"2012-01-13T18:00:00Z","modified":"2024-08-06T23:15:31Z","updated_at":"2026-11-03T01:39:53.544801Z"}],"ghsa":[{"id":"GHSA-76hr-qp66-cq6j","title":"Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44...","description":"Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.","status":"published","published":"2022-05-14T03:08:10Z","modified":"2023-02-10T05:06:17Z","updated_at":"2026-11-02T14:54:01.286462Z"}],"nvd":[{"id":"CVE-2011-2939","description":"Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.","status":"published","published":"2012-01-13T18:55:02.987Z","modified":"2026-06-16T23:32:17.613Z","cvss":[{"version":"2.0","score":5.1,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-189"],"updated_at":"2026-11-02T14:02:11.800512Z"}],"osv":[{"id":"CVE-2011-2939","description":"Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.","status":"published","published":"2012-01-13T18:55:02Z","modified":"2026-04-10T03:41:56.104639Z","updated_at":"2026-11-02T15:43:58.279353Z"},{"id":"DEBIAN-CVE-2011-2939","description":"Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.","status":"published","published":"2012-01-13T18:55:02.987Z","modified":"2026-10-23T17:47:39.189068412Z","updated_at":"2026-11-02T15:45:24.612044Z"},{"id":"RHSA-2011:1424","title":"Red Hat Security Advisory: perl security update","status":"published","published":"2024-09-15T19:31:42Z","modified":"2026-01-29T10:55:15.804488Z","updated_at":"2026-11-02T15:53:01.003286Z"}]}}