CVE-2011-2939: Buffer Overflow

Published Aug 17, 2011
·
Updated

Off-by-one error in the decodexs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.

Other sources

Perl bundles Encode' module (http://search.cpan.org/~dankogai/Encode/) that contains Unicode.xs' file where a heap overflow bug has been fixed recently (http://cpansearch.perl.org/src/DANKOGAI/Encode-2.44/Changes):

$Revision: 2.44 $ $Date: 2011/08/09 07:49:44 $ ! Unicode/Unicode.xs Addressed the following: Date: Fri, 22 Jul 2011 13:58:43 +0200 From: Robert Zacek <zacek> To: perl5-security-report Subject: Unicode.xs!decodexs n-byte heap-overflow

The patch has been merged into perl development tree (http://perl5.git.perl.org/perl.git/commitdiff/e46d973584785af1f445c4dedbee4243419cb860#patch5):

diff --git a/cpan/Encode/Unicode/Unicode.xs b/cpan/Encode/Unicode/Unicode.xs

index 16f4cd1..039f155 100644 (file)

--- a/cpan/Encode/Unicode/Unicode.xs +++ b/cpan/Encode/Unicode/Unicode.xs @@ -1,5 +1,5 @@ / - $Id: Unicode.xs,v 2.7 2010/12/31 22:48:48 dankogai Exp $ + $Id: Unicode.xs,v 2.8 2011/08/09 07:49:44 dankogai Exp dankogai $ / #define PERLNOGETCONTEXT @@ -256,7 +256,10 @@ CODE: This prevents allocating too much in the rogue case of a large input consisting initially of long sequence uft8-byte unicode chars followed by single utf8-byte chars. / - STRLEN remaining = (e - s)/usize; + / +1 + fixes Unicode.xs!decodexs n-byte heap-overflow + / + STRLEN remaining = (e - s)/usize + 1; / +1 to avoid the leak / STRLEN maxalloc = remaining + (810241024); STRLEN estalloc = remaining UTF8MAXLEN; STRLEN newlen = SvLEN(result) + / min(maxalloc, estalloc) /

Debian has applied the fix for Perl 5.12 and 5.14 versions (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=637376) so far but recognized the bug in all Perl releases since 5.10.0.

No reproducer or other details are known now. This flaw is public. Non-replied question has been post to perl-ports mailing list (http://permalink.gmane.org/gmane.comp.lang.perl.perl5.porters/98004).

— Red Hat

Affected Software

176 affected components
Dan Kogai Encode Module<=2.43
Dan Kogai Encode Module=0.93
Dan Kogai Encode Module=0.94
Dan Kogai Encode Module=0.95
Dan Kogai Encode Module=0.96
Dan Kogai Encode Module=0.97
Dan Kogai Encode Module=0.98
Dan Kogai Encode Module=0.99
Dan Kogai Encode Module=1.00
Dan Kogai Encode Module=1.01
Dan Kogai Encode Module=1.10
Dan Kogai Encode Module=1.11
Dan Kogai Encode Module=1.20
Dan Kogai Encode Module=1.21
Dan Kogai Encode Module=1.25
Dan Kogai Encode Module=1.26
Dan Kogai Encode Module=1.28
Dan Kogai Encode Module=1.30
Dan Kogai Encode Module=1.31
Dan Kogai Encode Module=1.32
Dan Kogai Encode Module=1.33
Dan Kogai Encode Module=1.34
Dan Kogai Encode Module=1.40
Dan Kogai Encode Module=1.41
Dan Kogai Encode Module=1.42
Dan Kogai Encode Module=1.50
Dan Kogai Encode Module=1.51
Dan Kogai Encode Module=1.52
Dan Kogai Encode Module=1.53
Dan Kogai Encode Module=1.54
Dan Kogai Encode Module=1.55
Dan Kogai Encode Module=1.56
Dan Kogai Encode Module=1.57
Dan Kogai Encode Module=1.58
Dan Kogai Encode Module=1.59
Dan Kogai Encode Module=1.60
Dan Kogai Encode Module=1.61
Dan Kogai Encode Module=1.62
Dan Kogai Encode Module=1.63
Dan Kogai Encode Module=1.64
Dan Kogai Encode Module=1.65
Dan Kogai Encode Module=1.66
Dan Kogai Encode Module=1.67
Dan Kogai Encode Module=1.68
Dan Kogai Encode Module=1.69
Dan Kogai Encode Module=1.70
Dan Kogai Encode Module=1.71
Dan Kogai Encode Module=1.72
Dan Kogai Encode Module=1.73
Dan Kogai Encode Module=1.74
Dan Kogai Encode Module=1.75
Dan Kogai Encode Module=1.76
Dan Kogai Encode Module=1.77
Dan Kogai Encode Module=1.78
Dan Kogai Encode Module=1.79
Dan Kogai Encode Module=1.80
Dan Kogai Encode Module=1.81
Dan Kogai Encode Module=1.82
Dan Kogai Encode Module=1.83
Dan Kogai Encode Module=1.84
Dan Kogai Encode Module=1.85
Dan Kogai Encode Module=1.86
Dan Kogai Encode Module=1.87
Dan Kogai Encode Module=1.88
Dan Kogai Encode Module=1.89
Dan Kogai Encode Module=1.90
Dan Kogai Encode Module=1.91
Dan Kogai Encode Module=1.92
Dan Kogai Encode Module=1.93
Dan Kogai Encode Module=1.94
Dan Kogai Encode Module=1.95
Dan Kogai Encode Module=1.96
Dan Kogai Encode Module=1.97
Dan Kogai Encode Module=1.98
Dan Kogai Encode Module=1.99
Dan Kogai Encode Module=2.0
Dan Kogai Encode Module=2.01
Dan Kogai Encode Module=2.02
Dan Kogai Encode Module=2.03
Dan Kogai Encode Module=2.04
Dan Kogai Encode Module=2.05
Dan Kogai Encode Module=2.06
Dan Kogai Encode Module=2.07
Dan Kogai Encode Module=2.08
Dan Kogai Encode Module=2.09
Dan Kogai Encode Module=2.10
Dan Kogai Encode Module=2.11
Dan Kogai Encode Module=2.12
Dan Kogai Encode Module=2.13
Dan Kogai Encode Module=2.14
Dan Kogai Encode Module=2.15
Dan Kogai Encode Module=2.16
Dan Kogai Encode Module=2.17
Dan Kogai Encode Module=2.18
Dan Kogai Encode Module=2.19
Dan Kogai Encode Module=2.20
Dan Kogai Encode Module=2.21
Dan Kogai Encode Module=2.22
Dan Kogai Encode Module=2.23
Dan Kogai Encode Module=2.24
Dan Kogai Encode Module=2.25
Dan Kogai Encode Module=2.26
Dan Kogai Encode Module=2.27
Dan Kogai Encode Module=2.28
Dan Kogai Encode Module=2.29
Dan Kogai Encode Module=2.30
Dan Kogai Encode Module=2.31
Dan Kogai Encode Module=2.32
Dan Kogai Encode Module=2.33
Dan Kogai Encode Module=2.34
Dan Kogai Encode Module=2.35
Dan Kogai Encode Module=2.36
Dan Kogai Encode Module=2.37
Dan Kogai Encode Module=2.38
Dan Kogai Encode Module=2.39
Dan Kogai Encode Module=2.40
Dan Kogai Encode Module=2.41
Dan Kogai Encode Module=2.42
Perl Perl<=5.14.2
Perl Perl=5.8.1
Perl Perl=5.8.2
Perl Perl=5.8.3
Perl Perl=5.8.4
Perl Perl=5.8.5
Perl Perl=5.8.6
Perl Perl=5.8.7
Perl Perl=5.8.8
Perl Perl=5.8.9
Perl Perl=5.8.10
Perl Perl=5.9.2
Perl Perl=5.10
Perl Perl=5.10.0
Perl Perl=5.10.0-rc1
Perl Perl=5.10.0-rc2
Perl Perl=5.10.1
Perl Perl=5.10.1-rc1
Perl Perl=5.10.1-rc2
Perl Perl=5.11.0
Perl Perl=5.11.1
Perl Perl=5.11.2
Perl Perl=5.11.3
Perl Perl=5.11.4
Perl Perl=5.11.5
Perl Perl=5.12.0
Perl Perl=5.12.0-rc0
Perl Perl=5.12.0-rc1
Perl Perl=5.12.0-rc2
Perl Perl=5.12.0-rc3
Perl Perl=5.12.0-rc4
Perl Perl=5.12.0-rc5
Perl Perl=5.12.1
Perl Perl=5.12.1-rc1
Perl Perl=5.12.1-rc2
Perl Perl=5.12.2
Perl Perl=5.12.2-rc1
Perl Perl=5.12.3
Perl Perl=5.12.3-rc1
Perl Perl=5.12.3-rc2
Perl Perl=5.12.3-rc3
Perl Perl=5.13.0
Perl Perl=5.13.1
Perl Perl=5.13.2
Perl Perl=5.13.3
Perl Perl=5.13.4
Perl Perl=5.13.5
Perl Perl=5.13.6
Perl Perl=5.13.7
Perl Perl=5.13.8
Perl Perl=5.13.9
Perl Perl=5.13.10
Perl Perl=5.13.11
Perl Perl=5.14.0
Perl Perl=5.14.0-rc1
Perl Perl=5.14.0-rc2
Perl Perl=5.14.0-rc3
Perl Perl=5.14.1

Remediation

Patch Available

http://perl5.git.perl.org/perl.git/commitdiff/e46d973584785af1f445c4dedbee4243419cb860#patch5

Patch Available

http://www.openwall.com/lists/oss-security/2011/08/19/17

Patch Available

https://bugzilla.redhat.com/show_bug.cgi?id=731246

Event History

Aug 17, 2011
Data Sourced
via Red Hat·06:59 AM
DescriptionSeverityAffected Software
Jan 13, 2012
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description

Frequently Asked Questions

1

What is the severity of CVE-2011-2939?

CVE-2011-2939 is considered a moderate severity vulnerability due to its potential to cause a denial of service via a memory corruption issue.

2

How do I fix CVE-2011-2939?

To fix CVE-2011-2939, you should upgrade the Encode module to version 2.44 or later.

3

Which versions are affected by CVE-2011-2939?

CVE-2011-2939 affects the Encode module versions prior to 2.44 and Perl versions prior to 5.15.6.

4

What type of vulnerability is CVE-2011-2939?

CVE-2011-2939 is categorized as a heap-based buffer overflow caused by an off-by-one error.

5

Can CVE-2011-2939 be exploited remotely?

Yes, CVE-2011-2939 can potentially be exploited by context-dependent attackers through specially crafted Unicode strings.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203