CVE-2005-3962: Buffer Overflow
First published: Thu Dec 01 2005(Updated: )
Integer overflow in the format string functionality (Perl_sv_vcatpvfn) in Perl 5.9.2 and 5.8.6 Perl allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via format string specifiers with large values, which causes an integer wrap and leads to a buffer overflow, as demonstrated using format string vulnerabilities in Perl applications.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Perl | =5.9.2 | |
| Perl | =5.8.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.dyadsecurity.com/perl-0002.html
- http://www.kb.cert.org/vuls/id/948385
- http://www.securityfocus.com/bid/15629
- http://secunia.com/advisories/17802
- http://secunia.com/advisories/17844
- http://secunia.com/advisories/17762
- http://www.openpkg.org/security/OpenPKG-SA-2005.025-perl.html
- http://www.gentoo.org/security/en/glsa/glsa-200512-01.xml
- http://www.trustix.org/errata/2005/0070
- http://secunia.com/advisories/17941
- http://secunia.com/advisories/17952
- http://www.redhat.com/support/errata/RHSA-2005-880.html
- http://www.novell.com/linux/security/advisories/2005_71_perl.html
- http://secunia.com/advisories/18183
- http://secunia.com/advisories/18187
- http://www.redhat.com/support/errata/RHSA-2005-881.html
- http://secunia.com/advisories/18075
- http://www.openbsd.org/errata37.html#perl
- http://secunia.com/advisories/18295
- http://www.osvdb.org/21345
- http://www.osvdb.org/22255
- http://secunia.com/advisories/18517
- http://secunia.com/advisories/17993
- https://www.redhat.com/archives/fedora-legacy-announce/2006-February/msg00008.html
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102192-1
- http://secunia.com/advisories/19041
- http://www.debian.org/security/2006/dsa-943
- http://secunia.com/advisories/18413
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=001056
- http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm
- http://www.novell.com/linux/security/advisories/2005_29_sr.html
- http://secunia.com/advisories/20894
- http://docs.info.apple.com/article.html?artnum=304829
- http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html
- http://www.us-cert.gov/cas/techalerts/TA06-333A.html
- http://secunia.com/advisories/23155
- http://www.mandriva.com/security/advisories?name=MDKSA-2005:225
- http://www.ipcop.org/index.php?name=News&file=article&sid=41
- http://secunia.com/advisories/31208
- http://www.vupen.com/english/advisories/2006/2613
- http://www.vupen.com/english/advisories/2006/0771
- http://www.vupen.com/english/advisories/2006/4750
- http://www.vupen.com/english/advisories/2005/2688
- http://marc.info/?l=full-disclosure&m=113342788118630&w=2
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1074
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10598
- https://usn.ubuntu.com/222-1/
- http://www.securityfocus.com/archive/1/438726/100/0/threaded
- http://www.securityfocus.com/archive/1/418333/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2005-3962?
CVE-2005-3962 is considered a high severity vulnerability due to its potential to allow arbitrary code execution.
How do I fix CVE-2005-3962?
To fix CVE-2005-3962, upgrade Perl to version 5.10.0 or later, which addresses the integer overflow issue.
What are the affected versions for CVE-2005-3962?
CVE-2005-3962 affects Perl versions 5.9.2 and 5.8.6.
What type of vulnerability is CVE-2005-3962?
CVE-2005-3962 is an integer overflow vulnerability related to the format string functionality in Perl.
Can CVE-2005-3962 lead to other security risks?
Yes, CVE-2005-3962 can lead to arbitrary memory overwriting, potentially resulting in further exploitation of the system.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/remedy
- agent/references
- agent/author
- agent/event
- agent/description
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/perl
- canonical/perl
- version/perl/5.9.2
- version/perl/5.8.6