FreshPorts - VuXML

Red Hat reports:

A flaw was found in Perl's regular expression engine. Specially crafted input to a regular expression can cause Perl to improperly allocate memory, possibly resulting in arbitrary code running with the permissions of the user running Perl.

gt 5.8.* lt 5.8.8_1

Perl developers report:

In order to prevent an algorithmic complexity attack against its hashing mechanism, perl will sometimes recalculate keys and redistribute the contents of a hash. This mechanism has made perl robust against attacks that have been demonstrated against other systems.

Research by Yves Orton has recently uncovered a flaw in the rehashing code which can result in pathological behavior. This flaw could be exploited to carry out a denial of service attack against code that uses arbitrary user input as hash keys.

Because using user-provided strings as hash keys is a very common operation, we urge users of perl to update their perl executable as soon as possible.

< 5.12.4_5

ge 5.14.0 lt 5.14.2_3

ge 5.16.0 lt 5.16.2_1

Kevin Finisterre discovered bugs in perl's I/O debug support:

• The environmental variable PERLIO_DEBUG is honored even by the set-user-ID perl command (usually named sperl or suidperl). As a result, a local attacker may be able to gain elevated privileges. (CVE-2005-0155)
• A buffer overflow may occur in threaded versions of perl when the full pathname of the script being executed is very long. (CVE-2005-0156).

Note: By default, no set-user-ID perl binary is installed. An administrator must enable it manually at build time with the ENABLE_SUIDPERL port flag.

ge 5.8 lt 5.8.6_2

Jeroen van Wolffelaar reports that the Perl module File::Path contains a race condition wherein traversed directories and files are temporarily made world-readable/writable.

ge 0 lt 5.6.2

ge 5.8.0 lt 5.8.6