Fedora: 2020-fd73c08076 critical: perl DoS due to Buffer Overflow

Perl is a high-level programming language with roots in C, sed, awk and shell

scripting. Perl is good at handling processes and files, and is especially

good at handling text. Perl's hallmarks are practicality and efficiency.

While it is used to do a lot of different things, Perl's most common

applications are system administration utilities and web programming.

This is a metapackage with all the Perl bits and core modules that can be

found in the upstream tarball from perl.org.

If you need only a specific feature, you can install a specific package

instead. E.g. to handle Perl scripts with /usr/bin/perl interpreter,

install perl-interpreter package. See perl-interpreter description for more

details on the Perl decomposition into packages.

Fixed CVE-2020-10543, CVE-2020-10878 and CVE-2020-12723

* Tue Jun 2 2020 Jitka Plesnikova - 4:5.30.2-452

- 5.30.3 bump (see

for release notes)

- Security release fixes CVE-2020-10543, CVE-2020-10878 and CVE-2020-12723

* Fri Mar 27 2020 Petr Pisar - 4:5.30.2-451

- Make perl-macros package noarch

- Work around a glibc bug in caching LC_MESSAGES (GH#17081)

- Fix POSIX:setlocale() documentation

- Prevent from an integer overflow in POSIX::SigSet()

- Fix thread-safety of IO::Handle (GH#14816)

- Close :unix PerlIO layers properly (bug #987118)

- Fix sorting tied arrays (GH#17496)

- Fix a spurious warning about a multidimensional syntax (GH#16535)

- Normalize "#!/perl" shebangs in the tests

- Fix a warning about an uninitialized value in B::Deparse (GH#17537)

* Mon Mar 16 2020 Jitka Plesnikova - 4:5.30.2-450

- 5.30.2 bump (see

for release notes)

* Fri Nov 29 2019 Petr Pisar - 4:5.30.1-449

- Fix a memory leak when compiling a regular expression with a non-word class

(GH#17218)

* Tue Nov 12 2019 Petr Pisar - 4:5.30.1-448

- Fix overloading for binary and octal floats (RT#125557)

- Fix handling undefined array members in Dumpvalue (RT#134441)

- Fix taint mode documentation regarding @INC

- Fix handling a layer argument in Tie::StdHandle::BINMODE() (RT#132475)

- Fix an unintended upgrade to UTF-8 in the middle of a transliteration

- Fix a race in File::stat() tests (GH#17234)

- Fix a buffer overread when parsing a number (GH#17279)

- Fix GCC 10 version detection (GH#17295)

* Mon Nov 11 2019 Jitka Plesnikova - 4:5.30.1-447

- 5.30.1 bump (see

for release notes)

[ 1 ] Bug #1837975 - CVE-2020-10543 perl: heap-based buffer overflow in regular expression compiler leads to DoS

https://bugzilla.redhat.com/show_bug.cgi?id=1837975

[ 2 ] Bug #1837988 - CVE-2020-10878 perl: corruption of intermediate language state of compiled regular expression due to integer overflow leads to DoS

https://bugzilla.redhat.com/show_bug.cgi?id=1837988

[ 3 ] Bug #1838000 - CVE-2020-12723 perl: corruption of intermediate language state of compiled regular expression due to recursive S_study_chunk() calls leads to DoS

https://bugzilla.redhat.com/show_bug.cgi?id=1838000

su -c 'dnf upgrade --advisory FEDORA-2020-fd73c08076' at the command

line. For more information, refer to the dnf documentation available at

https://dnf.readthedocs.io/en/latest/command_ref.html

All packages are signed with the Fedora Project GPG key. More details on the

GPG keys used by the Fedora Project can be found at

https://fedoraproject.org/security/

package-announce mailing list -- package-announce@lists.fedoraproject.org

To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org

Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/

List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines

List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/