MEDIUM
security flaw
Published Dec 1, 2005
4.6
MEDIUMCVSS 2.0
EPSS 1.37%
Description
Integer overflow in the format string functionality (Perl_sv_vcatpvfn) in Perl 5.9.2 and 5.8.6 Perl allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via format string specifiers with large values, which causes an integer wrap and leads to a buffer overflow, as demonstrated using format string vulnerabilities in Perl applications.
Affected products
No data.
No data.
Red Hat Enterprise Linux 3
perl-2:5.8.0-90.4
Fixed · RHSA-2005:881
Red Hat Enterprise Linux 4
perl-3:5.8.5-24.RHEL4
Fixed · RHSA-2005:880
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 3 | perl-2:5.8.0-90.4 | Fixed | RHSA-2005:881 |
| Red Hat Enterprise Linux 4 | perl-3:5.8.5-24.RHEL4 | Fixed | RHSA-2005:880 |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
No CVSS v3.1 score for this CVE.
No CVSS v3.0 score for this CVE.
4.6 MEDIUM NVD
AV:L/AC:L/Au:N/C:P/I:P/A:P
Access Vector Local
Access Complexity Low
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact Partial
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
1.37% 0.01374
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
EPSS probability 0.01374
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (9 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 1.37% (0.01374) | 71.00th | v5 (v2026.06.15) |
| Jun 15, 2026 | 1.37% (0.01374) | 68.34th | v5 (v2026.06.15) |
| Mar 17, 2025 | 0.61% (0.00607) | 67.83th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.15% (0.00151) | 52.77th | v3 (v2023.03.01) |
| Jun 13, 2024 | 0.15% (0.00151) | 51.52th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.15% (0.00151) | 49.49th | v3 (v2023.03.01) |
| Mar 6, 2023 | 4.42% (0.04421) | 88.21th | v2 (v2022.01.01) |
| Apr 1, 2022 | 4.42% (0.04421) | 87.03th | v2 (v2022.01.01) |
| Feb 4, 2022 | 4.42% (0.04421) | 70.83th | v2 (v2022.01.01) |
Weaknesses (1)
References (56)
- ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/007_perl.patch x_refsource_CONFIRM
- ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/001_perl.patch x_refsource_CONFIRM
- ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U vendor-advisoryx_refsource_SGI
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=001056 vendor-advisoryx_refsource_CONECTIVA
- http://docs.info.apple.com/article.html?artnum=304829 x_refsource_CONFIRM
- http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html vendor-advisoryx_refsource_APPLE
- http://marc.info/?l=full-disclosure&m=113342788118630&w=2 mailing-listx_refsource_FULLDISC
- http://secunia.com/advisories/17762 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/17802 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/17844 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/17941 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/17952 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/17993 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/18075 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/18183 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/18187 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/18295 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/18413 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/18517 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/19041 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/20894 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/23155 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/31208 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102192-1 vendor-advisoryx_refsource_SUNALERT
- http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm x_refsource_CONFIRM
- http://www.debian.org/security/2006/dsa-943 vendor-advisoryx_refsource_DEBIAN
- http://www.dyadsecurity.com/perl-0002.html x_refsource_MISCPatchVendor Advisory
- http://www.gentoo.org/security/en/glsa/glsa-200512-01.xml vendor-advisoryx_refsource_GENTOO
- http://www.ipcop.org/index.php?name=News&file=article&sid=41 x_refsource_CONFIRM
- http://www.kb.cert.org/vuls/id/948385 third-party-advisoryx_refsource_CERT-VNUS Government Resource
- http://www.mandriva.com/security/advisories?name=MDKSA-2005:225 vendor-advisoryx_refsource_MANDRAKE
- http://www.novell.com/linux/security/advisories/2005_29_sr.html vendor-advisoryx_refsource_SUSE
- http://www.novell.com/linux/security/advisories/2005_71_perl.html vendor-advisoryx_refsource_SUSE
- http://www.openbsd.org/errata37.html#perl vendor-advisoryx_refsource_OPENBSD
- http://www.openpkg.org/security/OpenPKG-SA-2005.025-perl.html vendor-advisoryx_refsource_OPENPKG
- http://www.osvdb.org/21345 vdb-entryx_refsource_OSVDB
- http://www.osvdb.org/22255 vdb-entryx_refsource_OSVDB
- http://www.redhat.com/support/errata/RHSA-2005-880.html vendor-advisoryx_refsource_REDHATVendor Advisory
- http://www.redhat.com/support/errata/RHSA-2005-881.html vendor-advisoryx_refsource_REDHATVendor Advisory
- http://www.securityfocus.com/archive/1/418333/100/0/threaded mailing-listx_refsource_BUGTRAQ
- http://www.securityfocus.com/archive/1/438726/100/0/threaded vendor-advisoryx_refsource_HP
- http://www.securityfocus.com/bid/15629 vdb-entryx_refsource_BID
- http://www.trustix.org/errata/2005/0070 vendor-advisoryx_refsource_TRUSTIX
- http://www.us-cert.gov/cas/techalerts/TA06-333A.html third-party-advisoryx_refsource_CERTUS Government Resource
- http://www.vupen.com/english/advisories/2005/2688 vdb-entryx_refsource_VUPEN
- http://www.vupen.com/english/advisories/2006/0771 vdb-entryx_refsource_VUPEN
- http://www.vupen.com/english/advisories/2006/2613 vdb-entryx_refsource_VUPENVendor Advisory
- http://www.vupen.com/english/advisories/2006/4750 vdb-entryx_refsource_VUPEN
- https://access.redhat.com/security/cve/CVE-2005-3962 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1617848 Issue Tracking
- https://nvd.nist.gov/vuln/detail/CVE-2005-3962
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10598 vdb-entrysignaturex_refsource_OVAL
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1074 vdb-entrysignaturex_refsource_OVAL
- https://usn.ubuntu.com/222-1/ vendor-advisoryx_refsource_UBUNTU
- https://www.cve.org/CVERecord?id=CVE-2005-3962
- https://www.redhat.com/archives/fedora-legacy-announce/2006-February/msg00008.html vendor-advisoryx_refsource_FEDORA
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Dec 1, 2005
Updated Aug 7, 2024
Reserved Dec 1, 2005
Link CVE-2005-3962
CISA Vulnrichment
Updated n/a