I've just pushed this commit to maint-5.14 and maint-5.12: commit 5ee2604e72cdd836101f279f8f9e89243c7f0097 Author: Andy Dougherty <doughera@lafayette.edu> Date: Thu Sep 27 09:52:18 2012 -0400 avoid calling memset with a negative count Poorly written perl code that allows an attacker to specify the count to perl's 'x' string repeat operator can already cause a memory exhaustion denial-of-service attack. A flaw in versions of perl before 5.15.5 can escalate that into a heap buffer overrun; coupled with versions of glibc before 2.16, it possibly allows the execution of arbitrary code. The flaw addressed to this commit has been assigned identifier CVE-2012-5195. A new 5.14.3 release is expected very soon, and a new 5.12.5 release will follow in a few weeks. -- rjbsThread Next