bugtraq - [ MDVSA-2013:005 ] perl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1TzqqP-0007MU-51@titan.mandriva.com>
Date: Mon, 28 Jan 2013 16:42:01 +0100
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2013:005 ] perl

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2013:005
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : perl
 Date    : January 28, 2013
 Affected: 2011., Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 A vulnerability has been found and corrected in perl:
 
 Heap-based buffer overflow in the Perl_repeatcpy function in util.c
 in Perl 5.12.x before 5.12.5, 5.14.x before 5.14.3, and 5.15.x before
 15.15.5 allows context-dependent attackers to cause a denial of service
 (memory consumption and crash) or possibly execute arbitrary code
 via the &#039;x&#039; string repeat operator (CVE-2012-5195).
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5195
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2011:
 2cd2f62ef4fd1fa7d765c5a0fb1292fb  2011/i586/perl-5.12.3-8.2-mdv2011.0.i586.rpm
 a87fedc92aa16e3eb09d3db9c37e1b01  2011/i586/perl-base-5.12.3-8.2-mdv2011.0.i586.rpm
 4dcef0206296645560413e267dd131fe  2011/i586/perl-devel-5.12.3-8.2-mdv2011.0.i586.rpm
 9df0bdda99e7e843943c5e77fba15036  2011/i586/perl-doc-5.12.3-8.2-mdv2011.0.noarch.rpm 
 b3daf9e368021a94048bf6f97a129a15  2011/SRPMS/perl-5.12.3-8.2.src.rpm

 Mandriva Linux 2011/X86_64:
 3b6ab1c60e98b72d7a2ab4fa1ef8f9eb  2011/x86_64/perl-5.12.3-8.2-mdv2011.0.x86_64.rpm
 38a74f3b9dc65b77c3e2a1ce2b7bf6d5  2011/x86_64/perl-base-5.12.3-8.2-mdv2011.0.x86_64.rpm
 f6e421797d0f1fbf064b59569e06e50a  2011/x86_64/perl-devel-5.12.3-8.2-mdv2011.0.x86_64.rpm
 58844f4e30df7e9962a9eb40ea0fbf29  2011/x86_64/perl-doc-5.12.3-8.2-mdv2011.0.noarch.rpm 
 b3daf9e368021a94048bf6f97a129a15  2011/SRPMS/perl-5.12.3-8.2.src.rpm

 Mandriva Enterprise Server 5:
 817cd182ec870213e66404c801de1338  mes5/i586/perl-5.10.0-25.5mdvmes5.2.i586.rpm
 19b31597c4116e2dd524ea3b324f58c4  mes5/i586/perl-base-5.10.0-25.5mdvmes5.2.i586.rpm
 ebe2a75601e9fb4ee43ce346abeea2ee  mes5/i586/perl-devel-5.10.0-25.5mdvmes5.2.i586.rpm
 60bc0e4584b2f8ca1b7a9cb1ee6c0d49  mes5/i586/perl-doc-5.10.0-25.5mdvmes5.2.i586.rpm
 bca381efbda683e01a473e4cd04de078  mes5/i586/perl-suid-5.10.0-25.5mdvmes5.2.i586.rpm 
 72c15bdff31cc3fc342a0f580fbea56b  mes5/SRPMS/perl-5.10.0-25.5mdvmes5.2.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 43baa4703a41bc31774b0c91b97d3021  mes5/x86_64/perl-5.10.0-25.5mdvmes5.2.x86_64.rpm
 44202ed5538712a00e47cea9a045ab3d  mes5/x86_64/perl-base-5.10.0-25.5mdvmes5.2.x86_64.rpm
 e07f48bf12258cf760ef662d8e08d137  mes5/x86_64/perl-devel-5.10.0-25.5mdvmes5.2.x86_64.rpm
 789fc82249d411994197f325086a7279  mes5/x86_64/perl-doc-5.10.0-25.5mdvmes5.2.x86_64.rpm
 5f2c518cc2497ef2ba1799579a99f581  mes5/x86_64/perl-suid-5.10.0-25.5mdvmes5.2.x86_64.rpm 
 72c15bdff31cc3fc342a0f580fbea56b  mes5/SRPMS/perl-5.10.0-25.5mdvmes5.2.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iD8DBQFRBm/CmqjQ0CJFipgRAnJKAJ91CDFCbmDVoGbyLdDZzp9BkVCe2ACgyNvv
I7lNiPK5bRvw59R2Cbc6J30=
=MD8F
-----END PGP SIGNATURE-----