UbuntuUpdates.org

Package "perl-doc"

Name: perl-doc

Description:

Perl documentation
Latest version: 5.40.1-7ubuntu0.3
Release: resolute (26.04)
Level: security
Repository: main
Head package: perl
Homepage: https://dev.perl.org/perl5/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "perl-doc"

All arch deb package
APT INSTALL

Other versions of "perl-doc" in Resolute

Repository Area Version
base main 5.40.1-7build1
updates main 5.40.1-7ubuntu0.3

Changelog

Version: 5.40.1-7ubuntu0.3 2026-09-09 16:07:37 UTC

perl (5.40.1-7ubuntu0.3) resolute-security; urgency=medium

  * SECURITY UPDATE: Out-of-bounds heap read in Socket pack_ip_mreq_source
    - debian/patches/CVE-2026-12087.patch: Scope STRLEN len per argument in
      pack_ip_mreq_source in cpan/Socket/Socket.xs
    - CVE-2026-12087
  * SECURITY UPDATE: Trie 16-bit overflow causing incorrect regex matches
    - debian/patches/CVE-2026-13221.patch: Skip trie creation when branch delta
      would overflow 16 bits in regcomp_study.c, t/re/pat_advanced.t
    - CVE-2026-13221
  * SECURITY UPDATE: Integer overflow leading to heap OOB read in pack/unpack
    - debian/patches/CVE-2026-57432_1.patch: Reject pack/unpack template sizes
      that would overflow SSize_t in pp_pack.c
    - debian/patches/CVE-2026-57432_2.patch: Avoid bit-count overflows in B/H
      template size math in pp_pack.c
    - CVE-2026-57432
  * SECURITY UPDATE: Signed int overflow in Storable SX_HOOK deserialization
    - debian/patches/CVE-2026-57433.patch: Reject I32_MAX hook data item counts
      before av_extend in dist/Storable/Storable.xs
    - CVE-2026-57433

 -- Shafayat Hossain Majumder Tue, 08 Sep 2026 14:17:45 -0400
Source diff to previous version
CVE-2026-12087 Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument
CVE-2026-13221 Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when
CVE-2026-57432 Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an
CVE-2026-57433 Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a sign

Version: 5.40.1-7ubuntu0.2 2026-09-08 16:08:00 UTC

perl (5.40.1-7ubuntu0.2) resolute-security; urgency=medium

  * SECURITY UPDATE: Out-of-bounds heap read and write during regular
    expression matching
    - debian/patches/CVE-2026-15534_1.patch: Make super-linear cache
      countdown unsigned in regexec.c.
    - debian/patches/CVE-2026-15534_2.patch: Make superlinear cache 64-bit
      clean in regexec.c, regexp.h.
    - CVE-2026-15534
  * SECURITY UPDATE: Incorrect regular expression matches from stale
    Aho-Corasick failure flag
    - debian/patches/CVE-2026-19487.patch: Reset stale failure flag in
      Aho-Corasick prescan in regexec.c, t/re/re_tests.
    - CVE-2026-19487

 -- Shafayat Hossain Majumder Thu, 03 Sep 2026 10:50:10 -0400
Source diff to previous version
CVE-2026-15534 Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_reg
CVE-2026-19487 Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan ear

Version: 5.40.1-7ubuntu0.1 2026-06-24 13:07:40 UTC

  perl (5.40.1-7ubuntu0.1) resolute-security; urgency=high

  * SECURITY UPDATE: path traversal in Archive::Tar symlink/hardlink extraction
    - debian/patches/CVE-2026-42496.patch: validate symlink and hardlink
      targets against absolute paths and directory traversal in
      cpan/Archive-Tar/lib/Archive/Tar.pm
    - CVE-2026-42496
  * SECURITY UPDATE: integer overflow in regular expression compiler
    - debian/patches/CVE-2026-8376_1.patch: add test cases for heap buffer
      overflow via quantified fixed-string regex in t/re/pat_psycho.t
    - debian/patches/CVE-2026-8376_2.patch: add overflow check before
      fixed-string buffer allocation in regcomp.c / regcomp_study.c
    - CVE-2026-8376

 -- Chrisa Oikonomou <email address hidden> Fri, 12 Jun 2026 16:42:16 +0300
CVE-2026-42496 Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file()
CVE-2026-8376 Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_stu


About   -   Send Feedback to @ubuntu_updates