CVE-2009-1391

NameCVE-2009-1391
DescriptionOff-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service (hang or crash) via a crafted zlib compressed stream that triggers a heap-based buffer overflow, as exploited in the wild by Trojan.Downloader-71014 in June 2009.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium
Debian Bugs532736, 532738

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libcompress-raw-zlib-perl (PTS)stretch2.069-1fixed
buster2.084-1fixed
bullseye, sid2.101-1fixed
perl (PTS)stretch5.24.1-3+deb9u7fixed
stretch (security)5.24.1-3+deb9u5fixed
buster5.28.1-6+deb10u1fixed
bullseye, sid5.32.1-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libcompress-raw-zlib-perlsourcelenny2.012-1lenny1
libcompress-raw-zlib-perlsource(unstable)2.015-2low532738
perlsourceetch(not affected)
perlsourcelenny5.10.0-19lenny1
perlsource(unstable)5.10.0-23low532736

Notes

[etch] - perl <not-affected> (Doesn't yet include Compress-Raw-Zlib)

Search for package or bug name: Reporting problems