CVE-2011-2939: Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause…

Description

Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.

Exploitation

Is it being used?

Exploit prediction (EPSS)2.6% · higher than 85% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

EM

Encode Module · Dan Kogai

through 2.43; 0.93; 0.94; 0.95; 0.96; 0.97; +34 more · source: NVD

PE

Perl · Perl

through 5.14.2; 5.8.1; 5.8.2; 5.8.3; 5.8.4; 5.8.5; +34 more · source: NVD