Front page | perl.perl5.porters |
Postings from October 2012
I've just pushed this commit to maint-5.14 and maint-5.12:
commit 5ee2604e72cdd836101f279f8f9e89243c7f0097
Author: Andy Dougherty <doughera@lafayette.edu>
Date: Thu Sep 27 09:52:18 2012 -0400
avoid calling memset with a negative count
Poorly written perl code that allows an attacker to specify the count to
perl's 'x' string repeat operator can already cause a memory exhaustion
denial-of-service attack. A flaw in versions of perl before 5.15.5 can
escalate that into a heap buffer overrun; coupled with versions of glibc
before 2.16, it possibly allows the execution of arbitrary code.
The flaw addressed to this commit has been assigned identifier
CVE-2012-5195.
A new 5.14.3 release is expected very soon, and a new 5.12.5 release will
follow in a few weeks.
--
rjbs
Thread Next