Fixes CVE-2025-40909 - Clone dirhandles without fchdir. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-30244ebfc7 2025-07-12 01:44:29.847248+00:00 -------------------------------------------------------------------------------- Name : perl Product : Fedora 42 Version : 5.40.2 Release : 518.fc42 URL : https://www.perl.org/ Summary : Practical Extraction and Report Language Description : Perl is a high-level programming language with roots in C, sed, awk and shell scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most common applications are system administration utilities and web programming. This is a metapackage with all the Perl bits and core modules that can be found in the upstream tarball from perl.org. If you need only a specific feature, you can install a specific package instead. E.g. to handle Perl scripts with /usr/bin/perl interpreter, install perl-interpreter package. See perl-interpreter description for more details on the Perl decomposition into packages. -------------------------------------------------------------------------------- Update Information: Fixes CVE-2025-40909 - Clone dirhandles without fchdir -------------------------------------------------------------------------------- ChangeLog: * Wed Jul 9 2025 Jitka Plesnikova - 4:5.40.2-518 - Fixes: CVE-2025-40909 - Clone dirhandles without fchdir -------------------------------------------------------------------------------- References: [ 1 ] Bug #2369463 - CVE-2025-40909 perl: Perl threads have a working directory race condition where file operations may target unintended paths [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2369463 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-30244ebfc7' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
* bsc#1244079 Cross-References: * CVE-2025-40909 . # Security update for perl Announcement ID: SUSE-SU-2025:02051-1 Release Date: 2025-06-20T12:42:29Z Rating: moderate References: * bsc#1244079 Cross-References: * CVE-2025-40909 CVSS scores: * CVE-2025-40909 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L * CVE-2025-40909 ( NVD ): 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Affected Products: * SUSE Linux Enterprise Server 12 SP5 * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security * SUSE Linux Enterprise Server for SAP Applications 12 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for perl fixes the following issues: * CVE-2025-40909: do not change the current directory when cloning an open directory handle (bsc#1244079) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2025-2051=1 ## Package List: * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (x86_64) * perl-base-debuginfo-5.18.2-12.29.1 * perl-debuginfo-32bit-5.18.2-12.29.1 * perl-debugsource-5.18.2-12.29.1 * perl-debuginfo-5.18.2-12.29.1 * perl-base-5.18.2-12.29.1 * perl-5.18.2-12.29.1 * perl-32bit-5.18.2-12.29.1 * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (noarch) * perl-doc-5.18.2-12.29.1 ## References: * https://www.suse.com/security/cve/CVE-2025-40909.html * https://bugzilla.suse.com/show_bug.cgi?id=1244079 . Moderate security patch for python targeting CVE-2024-34701. Apply updates to bolster overall system security.. SUSE Linux, security update, perl package, software patch, CVE-2025-40909. . LinuxSecurity.com Team
New samba packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] samba (SSA:2018-229-02) New samba packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: +--------------------------+ patches/packages/samba-4.6.16-i586-1_slack14.2.txz: Upgraded. This is a security release in order to address the following defects: Insufficient input validation on client directory listing in libsmbclient. A malicious server could return a directory entry that could corrupt libsmbclient memory. Confidential attribute disclosure from the AD LDAP server. Missing access control checks allow discovery of confidential attribute values via authenticated LDAP search expressions. For more information, see: https://www.cve.org/CVERecord?id=CVE-2018-10858 https://www.cve.org/CVERecord?id=CVE-2018-10919 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org/) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://www.slackware.com/ for additional mirror sites near you. Updated package for Slackware 14.0: Updated package for Slackware x86_64 14.0: Updated package for Slackware 14.1: Updated package for Slackware x86_64 14.1: Updated package for Slackware 14.2: Updated package for Slackware x86_64 14.2: Updated package for Slackware -current: Updated package for Slackware x86_64 -current: MD5 signatures: +-------------+ Slackware 14.0 package: 77145495c7596179c765c11515034dee samba-4.6.16-i486-1_slack14.0.txz Slackware x86_64 14.0 package: a30325cb28bdc8962baf2ed7d9825490 samba-4.6.16-x86_64-1_slack14.0.txz Slackware 14.1 package: a3ecca12612b54c71cf8ac1a2bb345a4 samba-4.6.16-i486-1_slack14.1.txz Slackware x86_64 14.1 package: ca7abaf3b91a765d14f2932ef2d4bba9 samba-4.6.16-x86_64-1_slack14.1.txz Slackware 14.2 package: 19ee8695015ead96d142a7f076def5d5 samba-4.6.16-i586-1_slack14.2.txz Slackware x86_64 14.2 package: dd0fee60c7b8c21d18f1d9fda5f7963a samba-4.6.16-x86_64-1_slack14.2.txz Slackware -current package: 843aa03e813d10d25216cb2b0fb2884d n/samba-4.8.4-i586-1.txz Slackware x86_64 -current package: d6ec2116d531e3b3e17b3c4b54fa645c n/samba-4.8.4-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg samba-4.6.16-i586-1_slack14.2.txz Then, if Samba is running restart it: # /etc/rc.d/rc.samba restart +-----+ . The newest Samba revision for Slackware addresses vital concerns regarding directory management and permissions, specifically those impacting secured attributes.. Samba Security, Slackware Packages, Access Control Issues. . Severity: Critical. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.