develooper Front page | perl.perl5.porters | Postings from October 2012

maint-5.12, maint-5.14, and CVE-2012-5195

Thread Next
From:
Ricardo Signes
Date:
October 10, 2012 05:22
Subject:
maint-5.12, maint-5.14, and CVE-2012-5195
Message ID:
20121010122205.GA3986@cancer.codesimply.com

I've just pushed this commit to maint-5.14 and maint-5.12:

  commit 5ee2604e72cdd836101f279f8f9e89243c7f0097
  Author: Andy Dougherty <doughera@lafayette.edu>
  Date:   Thu Sep 27 09:52:18 2012 -0400

      avoid calling memset with a negative count
      
      Poorly written perl code that allows an attacker to specify the count to
      perl's 'x' string repeat operator can already cause a memory exhaustion
      denial-of-service attack. A flaw in versions of perl before 5.15.5 can
      escalate that into a heap buffer overrun; coupled with versions of glibc
      before 2.16, it possibly allows the execution of arbitrary code.
      
      The flaw addressed to this commit has been assigned identifier
      CVE-2012-5195.

A new 5.14.3 release is expected very soon, and a new 5.12.5 release will
follow in a few weeks.

-- 
rjbs


Thread Next


nntp.perl.org: Perl Programming lists via nntp and http.
Comments to Ask Bjørn Hansen at ask@perl.org | Group listing | About