Vulnerability Report

CVE-2005-3962

Title: Perl format string integer overflow (Perl 5.9.2 / 5.8.6)

Memory Corruption

Proof Of Concept

No public PoC currently indexed for CVE-2005-3962.

CWE Category CWE-189

Published Date Dec 01, 2005

Modified Date Jun 16, 2026

Exploit Status Not Found

Score 4.6 CVSS v2.0

Exploit Probability (EPSS)

1.37%

Vulnerability Summary

CVE-2005-3962: Integer overflow in the format string functionality (Perl_sv_vcatpvfn) in Perl 5.9.2 and 5.8.6 Perl allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via format string specifiers with large values, which causes an integer wrap and leads to a buffer overflow, as demonstrated using format string vulnerabilities in Perl applications.

Impacted Vendors

perl 1

larry_wall 1

Reference Links

ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/007_perl.patch ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/001_perl.patch ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=001056 http://docs.info.apple.com/article.html?artnum=304829 http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html http://marc.info/?l=full-disclosure&m=113342788118630&w=2 http://secunia.com/advisories/17762 http://secunia.com/advisories/17802 http://secunia.com/advisories/17844 http://secunia.com/advisories/17941 http://secunia.com/advisories/17952 http://secunia.com/advisories/17993 http://secunia.com/advisories/18075 http://secunia.com/advisories/18183 http://secunia.com/advisories/18187 http://secunia.com/advisories/18295 http://secunia.com/advisories/18413 http://secunia.com/advisories/18517 http://secunia.com/advisories/19041 http://secunia.com/advisories/20894 http://secunia.com/advisories/23155 http://secunia.com/advisories/31208 http://sunsolve.sun.com/search/document.do?assetkey=1-26-102192-1 http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm http://www.debian.org/security/2006/dsa-943 http://www.dyadsecurity.com/perl-0002.html http://www.gentoo.org/security/en/glsa/glsa-200512-01.xml http://www.ipcop.org/index.php?name=News&file=article&sid=41 http://www.kb.cert.org/vuls/id/948385 http://www.mandriva.com/security/advisories?name=MDKSA-2005:225 http://www.novell.com/linux/security/advisories/2005_29_sr.html http://www.novell.com/linux/security/advisories/2005_71_perl.html http://www.openbsd.org/errata37.html#perl http://www.openpkg.org/security/OpenPKG-SA-2005.025-perl.html http://www.osvdb.org/21345 http://www.osvdb.org/22255 http://www.redhat.com/support/errata/RHSA-2005-880.html http://www.redhat.com/support/errata/RHSA-2005-881.html http://www.securityfocus.com/archive/1/418333/100/0/threaded http://www.securityfocus.com/archive/1/438726/100/0/threaded http://www.securityfocus.com/bid/15629 http://www.trustix.org/errata/2005/0070 http://www.us-cert.gov/cas/techalerts/TA06-333A.html http://www.vupen.com/english/advisories/2005/2688 http://www.vupen.com/english/advisories/2006/0771 http://www.vupen.com/english/advisories/2006/2613 http://www.vupen.com/english/advisories/2006/4750 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10598 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1074 https://usn.ubuntu.com/222-1/ https://www.redhat.com/archives/fedora-legacy-announce/2006-February/msg00008.html ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/007_perl.patch ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/001_perl.patch ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=001056 http://docs.info.apple.com/article.html?artnum=304829 http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html http://marc.info/?l=full-disclosure&m=113342788118630&w=2 http://secunia.com/advisories/17762 http://secunia.com/advisories/17802 http://secunia.com/advisories/17844 http://secunia.com/advisories/17941 http://secunia.com/advisories/17952 http://secunia.com/advisories/17993 http://secunia.com/advisories/18075 http://secunia.com/advisories/18183 http://secunia.com/advisories/18187 http://secunia.com/advisories/18295 http://secunia.com/advisories/18413 http://secunia.com/advisories/18517 http://secunia.com/advisories/19041 http://secunia.com/advisories/20894 http://secunia.com/advisories/23155 http://secunia.com/advisories/31208 http://sunsolve.sun.com/search/document.do?assetkey=1-26-102192-1 http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm http://www.debian.org/security/2006/dsa-943 http://www.dyadsecurity.com/perl-0002.html http://www.gentoo.org/security/en/glsa/glsa-200512-01.xml http://www.ipcop.org/index.php?name=News&file=article&sid=41 http://www.kb.cert.org/vuls/id/948385 http://www.mandriva.com/security/advisories?name=MDKSA-2005:225 http://www.novell.com/linux/security/advisories/2005_29_sr.html http://www.novell.com/linux/security/advisories/2005_71_perl.html http://www.openbsd.org/errata37.html#perl http://www.openpkg.org/security/OpenPKG-SA-2005.025-perl.html http://www.osvdb.org/21345 http://www.osvdb.org/22255 http://www.redhat.com/support/errata/RHSA-2005-880.html http://www.redhat.com/support/errata/RHSA-2005-881.html http://www.securityfocus.com/archive/1/418333/100/0/threaded http://www.securityfocus.com/archive/1/438726/100/0/threaded http://www.securityfocus.com/bid/15629 http://www.trustix.org/errata/2005/0070 http://www.us-cert.gov/cas/techalerts/TA06-333A.html http://www.vupen.com/english/advisories/2005/2688 http://www.vupen.com/english/advisories/2006/0771 http://www.vupen.com/english/advisories/2006/2613 http://www.vupen.com/english/advisories/2006/4750 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10598 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1074 https://usn.ubuntu.com/222-1/ https://www.redhat.com/archives/fedora-legacy-announce/2006-February/msg00008.html

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

4.6

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:L/AC:L/Au:N/C:P/I:P/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2005-3962 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

June 16, 2026 MODIFIED

Vulnerability data updated via NVD.

April 03, 2025 MODIFIED

Vulnerability data or affected products updated.

December 01, 2005 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A

Complexity N/A

Privileges N/A

Interaction NONE

CVSS Vector String


                                    AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected Stack

No specific products linked.