CVE-2005-0156

Severity: low (CVSS 2.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-02-07 · updated 2026-06-16

Description

Buffer overflow in the PerlIO implementation in Perl 5.8.0, when installed with setuid support (sperl), allows local users to execute arbitrary code by setting the PERLIO_DEBUG variable and executing a Perl script whose full pathname contains a long directory tree.

Affected products

IBM AIX: 5.2, 5.3
Larry Wall Perl: 5.8.0, 5.8.1, 5.8.3, 5.8.4, 5.8.4.1, 5.8.4.2 (+4)
Red Hat Enterprise Linux: 3.0
RedHat Enterprise Linux Desktop: 3.0
RedHat Fedora Core: core_3.0
Sgi Propack: 3.0
Suse Linux: 8.0, 8.1, 8.2, 9.0, 9.1, 9.2
Trustix Secure Linux: 1.5, 2.0, 2.1, 2.2
Ubuntu Linux: 4.1

References

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=001056
http://fedoranews.org/updates/FEDORA--.shtml
http://marc.info/?l=bugtraq&m=110737149402683&w=2
http://marc.info/?l=full-disclosure&m=110779721503111&w=2
http://secunia.com/advisories/14120
http://secunia.com/advisories/55314
http://www.digitalmunition.com/DMA%5B2005-0131b%5D.txt
http://www.gentoo.org/security/en/glsa/glsa-200502-13.xml
http://www.mandriva.com/security/advisories?name=MDKSA-2005:031
http://www.redhat.com/support/errata/RHSA-2005-103.html
http://www.redhat.com/support/errata/RHSA-2005-105.html
http://www.securityfocus.com/bid/12426

Get alerted when CVE-2005-0156 or the next vulnerability affects your stack