Description
The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | perl | 5.10.1-20 | — |
| Debian 13 | perl | 5.10.1-20 | — |
| Debian 12 | perl | 5.10.1-20 | — |
| Debian 6.0 | perl | 5.10.1-17squeeze1 | DSA-2265-1 |
| Debian 5.0 | perl | 5.10.0-19lenny4 | DSA-2265-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | perl +3 | 4:5.10.1-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Archive-Extract | 1:0.38-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Archive-Tar | 1.58-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-CGI | 3.51-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-CPAN | 1.9402-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-CPANPLUS | 0.88-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Compress-Raw-Zlib | 2.023-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Compress-Zlib +2 | 2.020-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Digest-SHA | 1:5.47-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-ExtUtils-CBuilder | 1:0.27-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-ExtUtils-Embed | 1.28-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-ExtUtils-MakeMaker | 6.55-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-ExtUtils-ParseXS | 1:2.2003.0-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-File-Fetch | 0.26-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-IO-Zlib | 1:1.09-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-IPC-Cmd | 1:0.56-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Locale-Maketext-Simple | 1:0.18-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Log-Message +2 | 1:0.02-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Log-Message-Simple | 0.04-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Module-Build | 1:0.3500-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Module-CoreList | 2.18-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Module-Load | 1:0.16-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Module-Load-Conditional | 0.30-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Module-Pluggable | 1:3.90-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Object-Accessor | 1:0.34-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Params-Check | 1:0.26-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Parse-CPAN-Meta | 1:1.40-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Pod-Escapes | 1:1.04-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Pod-Simple | 1:3.13-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Term-UI | 0.20-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Test-Harness | 3.17-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Test-Simple | 0.92-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Time-HiRes | 4:1.9721-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Time-Piece | 1.15-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-core | 5.10.1-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-parent | 1:0.221-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-version | 3:0.77-119.el6 | RHSA-2011:0558 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Perl 5.x - 'lc()' / 'uc()' TAINT Mode Protection Security Bypass EDB-35554 · remote · Mar 30, 2011 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- RHSA-2011:0558 Red Hat Security Advisory: perl security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2265-1 perl - missing taint check Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=692844
- SUSE-SR:2011:009 vendor-advisory
- FEDORA-2011-4610 vendor-advisory
- 44168 third-party-advisory
- 43921 third-party-advisory
- DSA-2265 vendor-advisory
- FEDORA-2011-4631 vendor-advisory
- http://rt.perl.org/rt3/Public/Bug/Display.html?id=87336
- 47124 vdb-entry
- [oss-security] 20110404 Re: CVE Request -- perl -- lc(), uc() routines are laundering tainted data mailing-list
- http://perl5.git.perl.org/perl.git/commit/539689e74a3bcb04d29e4cd9396de91a81045b99
- https://bugzilla.redhat.com/show_bug.cgi?id=692898
- MDVSA-2011:091 vendor-advisory
- perl-laundering-security-bypass(66528) vdb-entry
- [oss-security] 20110401 CVE Request -- perl -- lc(), uc() routines are laundering tainted data mailing-list