Ubuntu 12.10: 2099-1 Moderate: Perl Code Execution Threat

ubuntu

February 5, 2014

Perl could be made to run programs if it processed a specially crafted Locale::Maketext templates.

Summary

Perl could be made to run programs if it processed a specially crafted

Locale::Maketext templates.

Software Description:

- perl: Practical Extraction and Report Language

Details:

It was discovered that Perl's Locale::Maketext module incorrectly handled

backslashes and fully qualified method names. An attacker could possibly

use this flaw to execute arbitrary code when an application used untrusted

templates.

Topics Covered

security advisory code execution software patch Ubuntu update instructions Perl locale templates

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
  perl-modules                    5.14.2-13ubuntu0.3

Ubuntu 12.04 LTS:
  perl-modules                    5.14.2-6ubuntu2.4

Ubuntu 10.04 LTS:
  perl-modules                    5.10.1-8ubuntu2.4

In general, a standard system update will make all the necessary changes.