Description
Integer overflow in the format string functionality (Perl_sv_vcatpvfn) in Perl 5.9.2 and 5.8.6 Perl allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via format string specifiers with large values, which causes an integer wrap and leads to a buffer overflow, as demonstrated using format string vulnerabilities in Perl applications.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | perl | 5.8.7-9 | — |
| Debian 13 | perl | 5.8.7-9 | — |
| Debian 12 | perl | 5.8.7-9 | — |
| Debian 3.1 | perl | 5.8.4-8sarge3 | DSA-943-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | perl +1 | 3:5.8.5-24.RHEL4 | RHSA-2005:880 |
| RHEL 3 | perl +1 | 2:5.8.0-90.4 | RHSA-2005:881 |
| RHEL 3 | perl-CGI | 2:2.89-90.4 | RHSA-2005:881 |
| RHEL 3 | perl-CPAN | 2:1.61-90.4 | RHSA-2005:881 |
| RHEL 3 | perl-DB_File | 2:1.806-90.4 | RHSA-2005:881 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | perl | 5.34.0-1.1 | openSUSE-SU-2024:11158-1 |
Advisories 4
- RHSA-2005:881 Red Hat Security Advisory: perl security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:880 Red Hat Security Advisory: perl security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-943-1 perl - integer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11158-1 perl-32bit-5.34.0-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- ADV-2006-4750 vdb-entry
- oval:org.mitre.oval:def:1074 vdb-entry signature
- VU#948385 third-party-advisory
- 22255 vdb-entry
- 17941 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm
- 20051201 Perl format string integer wrap vulnerability mailing-list
- HPSBTU02125 vendor-advisory
- 20051201 Perl format string integer wrap vulnerability mailing-list
- ADV-2005-2688 vdb-entry
- http://www.dyadsecurity.com/perl-0002.html
- 21345 vdb-entry
- 15629 vdb-entry
- RHSA-2005:881 vendor-advisory
- http://docs.info.apple.com/article.html?artnum=304829
- oval:org.mitre.oval:def:10598 vdb-entry signature
- DSA-943 vendor-advisory
- [3.7] 20060105 007: SECURITY FIX: January 5, 2006 vendor-advisory
- 17993 third-party-advisory
- 18075 third-party-advisory
- FLSA-2006:176731 vendor-advisory
- CLSA-2006:1056 vendor-advisory
- OpenPKG-SA-2005.025 vendor-advisory
- ADV-2006-0771 vdb-entry
- 20894 third-party-advisory
- USN-222-1 vendor-advisory
- ADV-2006-2613 vdb-entry
- 18413 third-party-advisory
- 23155 third-party-advisory
- 17762 third-party-advisory
- 18187 third-party-advisory
- TSLSA-2005-0070 vendor-advisory
- 18517 third-party-advisory
- 18295 third-party-advisory
- SUSE-SA:2005:071 vendor-advisory
- 18183 third-party-advisory
- RHSA-2005:880 vendor-advisory
- APPLE-SA-2006-11-28 vendor-advisory
- TA06-333A third-party-advisory
- 102192 vendor-advisory
- 17952 third-party-advisory
- MDKSA-2005:225 vendor-advisory
- http://www.ipcop.org/index.php?name=News&file=article&sid=41
- GLSA-200512-01 vendor-advisory
- 31208 third-party-advisory
- 17802 third-party-advisory
- SUSE-SR:2005:029 vendor-advisory
- 19041 third-party-advisory
- 17844 third-party-advisory