Fix three security vulnerabilities in perl 5.38.4: - CVE-2026-13221: regex trie overflow causing incorrect matches when alternation has more than 65535 fixed string branches (CVSS 9.1) - CVE-2026-57432: integer overflow in pack/unpack leading to out-of-bounds heap read (CVSS 8.4) - CVE-2025-40909: threads working directory race condition allowing file operations to target unintended paths
CVE-2025-40909 is fixed upstream in perl 5.42.0. CVE-2026-13221 and CVE-2026-57432 are fixed upstream in perl 5.44.0. Jaipaul Cheernam (3): perl: fix CVE-2026-13221 perl: fix CVE-2026-57432 perl: fix CVE-2025-40909 .../perl/files/CVE-2025-40909.patch | 412 ++++++++++++++++++ .../perl/files/CVE-2026-13221.patch | 75 ++++ .../perl/files/CVE-2026-57432-01.patch | 52 +++ .../perl/files/CVE-2026-57432-02.patch | 34 ++ meta/recipes-devtools/perl/perl_5.38.4.bb | 4 + 5 files changed, 577 insertions(+) create mode 100644 meta/recipes-devtools/perl/files/CVE-2025-40909.patch create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-13221.patch create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-57432-01.patch create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-57432-02.patch
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#241525): https://lists.openembedded.org/g/openembedded-core/message/241525 Mute This Topic: https://lists.openembedded.org/mt/120376717/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
