mbox series

[wrynose,0/2] perl: fix multiple CVEs

Message ID 20260721134543.16442-1-jaipaul.cheernam@est.tech
Headers show
Series perl: fix multiple CVEs | expand

Message

Jaipaul Cheernam July 21, 2026, 1:45 p.m. UTC
Fix two security vulnerabilities in perl 5.42.0:

- CVE-2026-13221: regex trie overflow causing incorrect matches when
  alternation has more than 65535 fixed string branches (CVSS 9.1)
- CVE-2026-57432: integer overflow in pack/unpack leading to
  out-of-bounds heap read (CVSS 8.4)

Both are fixed upstream in perl 5.44.0.

Jaipaul Cheernam (2):
  perl: fix CVE-2026-13221
  perl: fix CVE-2026-57432

 .../perl/files/CVE-2026-13221.patch           | 75 +++++++++++++++++++
 .../perl/files/CVE-2026-57432-01.patch        | 52 +++++++++++++
 .../perl/files/CVE-2026-57432-02.patch        | 34 +++++++++
 meta/recipes-devtools/perl/perl_5.42.0.bb     |  3 +
 4 files changed, 164 insertions(+)
 create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-13221.patch
 create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-57432-01.patch
 create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-57432-02.patch