[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Full-disclosure] [SECURITY] [DSA 2586-1] perl security update
- To: debian-security-announce@xxxxxxxxxxxxxxxx
- Subject: [Full-disclosure] [SECURITY] [DSA 2586-1] perl security update
- From: Florian Weimer <fw@xxxxxxxxxxxxx>
- Date: Tue, 11 Dec 2012 20:11:09 +0100
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- -------------------------------------------------------------------------
Debian Security Advisory DSA-2586-1 security@xxxxxxxxxx
http://www.debian.org/security/
December 11, 2012 http://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : perl
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE ID : CVE-2012-5195 CVE-2012-5526
Debian Bug : 689314 693420 695223
Two vulnerabilities were discovered in the implementation of the Perl
programming language:
CVE-2012-5195
The "x" operator could cause the Perl interpreter to crash
if very long strings were created.
CVE-2012-5526
The CGI module does not properly escape LF characters
in the Set-Cookie and P3P headers.
In addition, this update adds a warning to the Storable documentation
that this package is not suitable for deserializing untrusted data.
For the stable distribution (squeeze), these problems have been fixed in
version 5.10.1-17squeeze4.
For the unstable distribution (sid), these problems have been fixed in
version 5.14.2-16.
We recommend that you upgrade your perl packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/
Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iQEcBAEBAgAGBQJQx4YKAAoJEL97/wQC1SS+/VkIAIpSd3dfeM3O7ggbBmmhYTrW
Ugj+6/U+re95NccRkev2cwMq15ZAD24IQWJC9ALs+zQp22kr3LTgUq7apviHLst2
LNdBvZVx5YKYQMhScu92vRij/q5SJmvmIzfdZxLMiF+YJm+7rno/m75PSQA9qAB1
LlhYHWX9ehLC2G6XLRs0HJl+ROaFmyxv1EC7MYqOk06VMoAsjN6u77L+A27lG0Hx
CJYN7+4IDQO+Jd9nKMyPGQWE3XisbyOE/IJvytquRYgxVCD933Z4nLhz9RyTYL2k
Zn12cAfgzxKhBjokIlfHwOQfrIKOBWA2OQSHaDJQQ1tAJ27ml2KyZZL2AiS9Lg0=
=sJXD
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/