Unscored severity · published Apr 11, 2011
CVE-2011-1487
The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the…
–
CVSS
10.6%
EPSS
No
On KEV
Description
The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.
Exploitation
Is it being used?
Exploit prediction (EPSS)10.6% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PE
Perl · Perl
5.10.0; 5.10.0; 5.10.0; 5.10.1; 5.10.1; 5.10.1; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-1487
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-1487
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057891.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057971.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
Exploit
http://openwall.com/lists/oss-security/2011/04/01/3
Exploit
http://openwall.com/lists/oss-security/2011/04/04/35
Patch
http://perl5.git.perl.org/perl.git/commit/539689e74a3bcb04d29e4cd9396de91a81045b99
More from Perl
9.8
CVE-2026-8376
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds
9.8
CVE-2026-4176
Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib
9.8
CVE-2022-48522
In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation
9.8
CVE-2018-18314
Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations
9.8
CVE-2018-18311
Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations