Security Information / 2017 / Security Information -- DSA-3982-1 perl

Debian Security Advisory

DSA-3982-1 perl -- security update

Date Reported:

21 Sep 2017

Affected Packages:

perl

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 875596, Bug 875597.
In Mitre's CVE dictionary: CVE-2017-12837, CVE-2017-12883.

More information:

Multiple vulnerabilities were discovered in the implementation of the Perl programming language. The Common Vulnerabilities and Exposures project identifies the following problems:

• CVE-2017-12837

  Jakub Wilk reported a heap buffer overflow flaw in the regular expression compiler, allowing a remote attacker to cause a denial of service via a specially crafted regular expression with the case-insensitive modifier.

• CVE-2017-12883

  Jakub Wilk reported a buffer over-read flaw in the regular expression parser, allowing a remote attacker to cause a denial of service or information leak.

For the oldstable distribution (jessie), these problems have been fixed in version 5.20.2-3+deb8u9.

For the stable distribution (stretch), these problems have been fixed in version 5.24.1-3+deb9u2.

For the testing distribution (buster), these problems have been fixed in version 5.26.0-8.

For the unstable distribution (sid), these problems have been fixed in version 5.26.0-8.

We recommend that you upgrade your perl packages.