develooper Front page | perl.perl5.porters | Postings from October 2012

maint-5.12, maint-5.14, and CVE-2012-5195

Thread Next
Ricardo Signes
October 10, 2012 05:22
maint-5.12, maint-5.14, and CVE-2012-5195
Message ID:

I've just pushed this commit to maint-5.14 and maint-5.12:

  commit 5ee2604e72cdd836101f279f8f9e89243c7f0097
  Author: Andy Dougherty <>
  Date:   Thu Sep 27 09:52:18 2012 -0400

      avoid calling memset with a negative count
      Poorly written perl code that allows an attacker to specify the count to
      perl's 'x' string repeat operator can already cause a memory exhaustion
      denial-of-service attack. A flaw in versions of perl before 5.15.5 can
      escalate that into a heap buffer overrun; coupled with versions of glibc
      before 2.16, it possibly allows the execution of arbitrary code.
      The flaw addressed to this commit has been assigned identifier

A new 5.14.3 release is expected very soon, and a new 5.12.5 release will
follow in a few weeks.

Thread Next Perl Programming lists via nntp and http.
Comments to Ask Bjørn Hansen at | Group listing | About