[ubuntu/questing-security] perl 5.40.1-6ubuntu0.1 (Accepted)

[Chrisa Oikonomou]

perl (5.40.1-6ubuntu0.1) questing-security; urgency=high

  * SECURITY UPDATE: path traversal in Archive::Tar symlink/hardlink extraction
    - debian/patches/CVE-2026-42496.patch: validate symlink and hardlink
      targets against absolute paths and directory traversal in
      cpan/Archive-Tar/lib/Archive/Tar.pm
    - CVE-2026-42496
  * SECURITY UPDATE: integer overflow in regular expression compiler
    - debian/patches/CVE-2026-8376_1.patch: add test cases for heap buffer
      overflow via quantified fixed-string regex in t/re/pat_psycho.t
    - debian/patches/CVE-2026-8376_2.patch: add overflow check before
      fixed-string buffer allocation in regcomp.c / regcomp_study.c
    - CVE-2026-8376
  * debian/rules: temporarily disable flaky op/magic.t test during build
    in questing environment to allow security updates to proceed

Date: 2026-06-30 11:50:14.322858+00:00
Changed-By: Chrisa Oikonomou <chrisa.oikonomou at canonical.com>
https://launchpad.net/ubuntu/+source/perl/5.40.1-6ubuntu0.1
-------------- next part --------------
Sorry, changesfile not available.