-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 29 Sep 2026 08:59:07 +0700 Source: perl Architecture: source Version: 5.36.0-7+deb12u4 Distribution: bookworm-security Urgency: high Maintainer: Niko Tyni <ntyni@debian.org> Changed-By: Arnaud Rebillout <arnaudr@debian.org> Closes: 1137345 1138854 1138856 1138858 1138859 1138860 1138863 1138905 1138906 1140152 1141639 1142037 1144668 Changes: perl (5.36.0-7+deb12u4) bookworm-security; urgency=high . * Non-maintainer upload by the LTS Team. * [SECURITY] various upstream fixes: + CVE-2026-7017: HTTP::Tiny credential forwarding on redirects. (Closes: #1141639) + CVE-2026-42496: Archive::Tar symlink extraction. (Closes: #1138860) + CVE-2026-42497: Archive::Tar hardlink extraction. (Closes: #1138859) + CVE-2026-12087: Socket: pack_ip_mreq_source() out-of-bounds heap read. (Closes: #1140152) + CVE-2026-13221: silently incorrect regular expression matches. (Closes: #1142037) + CVE-2025-15649: header parsing in IO::Uncompress::Unzip. (Closes: #1138863) + CVE-2026-7010: CRLF-validation in HTTP::Tiny. (Closes: #1138858) + CVE-2026-8376: Buffer overflow in Perl_study_chunk. (Closes: #1137345) + CVE-2026-48959: CPU exhaustion in IO::Uncompress::Unzip. (Closes: #1138856) + CVE-2026-48962: code execution in IO-Compress via output globs. (Closes: #1138854) + CVE-2026-57432: out of bound heap reads in pack() and unpack(). (Closes: #1138905) + CVE-2026-57433: signed integer overflow in Storable. (Closes: #1138906) + CVE-2026-19487: incorrect regular expression match results (Closes: #1144668) Checksums-Sha1: deee455a754c1dff25218c26f68898317f4842e3 2922 perl_5.36.0-7+deb12u4.dsc 482ccf337df6318fad5c2621afbe6794d58a0ec5 417784 perl_5.36.0.orig-regen-configure.tar.xz 938c56a77ae094eb7f5019318a5e4efb2d9c74fa 13051500 perl_5.36.0.orig.tar.xz 6fac7e37c9a661d5b3c2ca8f9bfbe64bd7d70398 190620 perl_5.36.0-7+deb12u4.debian.tar.xz 655187ed5a115e2efe5d1d2719d54fdc42501c58 6114 perl_5.36.0-7+deb12u4_source.buildinfo Checksums-Sha256: 6f71e571ae69894ad2115013bbc3207e77dc796581e30a62be0297e7d90ee7b9 2922 perl_5.36.0-7+deb12u4.dsc 10ac353bc5a933403afe60ed1817e7a456f99bdbcaf80c1cdb0eb3a08ea56d4e 417784 perl_5.36.0.orig-regen-configure.tar.xz 0f386dccbee8e26286404b2cca144e1005be65477979beb9b1ba272d4819bcf0 13051500 perl_5.36.0.orig.tar.xz f49d224fa9a6a356e1140f95fb5c864864b5423c9aece94cc68b4d348a3694b6 190620 perl_5.36.0-7+deb12u4.debian.tar.xz d6df828c3b33a059e5cb77f47e3caefc6c70515beb2db00d94c742b12672bc7e 6114 perl_5.36.0-7+deb12u4_source.buildinfo Files: a4f32f02c701a76bb592be386429f194 2922 perl standard perl_5.36.0-7+deb12u4.dsc 4cb6eb41483cc04369cf93367ea6e019 417784 perl standard perl_5.36.0.orig-regen-configure.tar.xz 826e42da130011699172fd655e49cfa2 13051500 perl standard perl_5.36.0.orig.tar.xz dac842767d3856f0298e1775ffd8c226 190620 perl standard perl_5.36.0-7+deb12u4.debian.tar.xz cd18e094aef1bfcba4870339a1b155c5 6114 perl standard perl_5.36.0-7+deb12u4_source.buildinfo -----BEGIN PGP SIGNATURE----- iQJHBAEBCgAxFiEE0Kl7ndbut+9n4bYs5yXoeRRgAhYFAmrDVvsTHGFybmF1ZHJA ZGViaWFuLm9yZwAKCRDnJeh5FGACFr2jD/9StqLWLGh9IBSkBGiysbqyOMcA06hy oKwY4q4CZvzpBCas2jhUxii5CsXaOIkJ1acVxi1hcyqvCxKczj0HrTTWDVaubwSU B38igDHxj+bNDLk8VhghdOH/Jn2gLXT7GoN7xzMYl3jrLIIadLxKRqJKtXqQhJuQ +ZsWTYH/ONA7/oIUbA6YLiXTxyJ49ai+llXWUrikAFlixh5RqGjZHUxXXc6qXM/U lRjXIHTB62EnZJn+6ab6Wf+2GMYkBqwix0JjijfvxIGbvRtOn9nAgxu51XWYb0Th F2tcQkJfBVjH9yQ19XgxekAOv5CRsybLmnpFdJVLpEkEwRlnJBv2j5TmEByDcPdl ndagPmQi3byyfqWNF8zwuOVbthjvqrOOr+DO0nxfhzi7qF7UPqpcCZ/fcItmYfao cQ1vl6F7Xgx9/NaLwSnIqkGDRL4HKW69Hhzpm7bghQpZagNwg31ZYJ2IcesQU5d+ VcHGGHEci2LHK23013CmwwajgFWrVcsuukk7BuYmbv9TB0AUrQbrhBK9RgfwQZDa Rcomz7oDemQNH2v1pNmudRkkbMaUB6eL5ZATXrNO+GdC0ScoMAj7J4qxlFuckLEY NMg5e6R7rYsN1iqIGSrNYdO2JZA6IJpmqoAYGabKb2xmWmc5JDDCqBVPbnQQ5bY7 j6098bIyqr4SOQ== =Qbnb -----END PGP SIGNATURE-----
