Debian Patches
Status for perl/5.36.0-7+deb12u4
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| debian/cpan_definstalldirs.diff | Provide a sensible INSTALLDIRS default for modules installed from CPAN. Some modules which are included in core set INSTALLDIRS => 'perl' explicitly in Makefile.PL or Build.PL. This makes sense for the normal @INC ordering, but not ours. |
Brendan O'Dea <bod@debian.org> | no | 2005-03-08 | ||
| debian/db_file_ver.diff | Remove overly restrictive DB_File version check. Package dependencies ensure the correct library is linked at run-time. |
Brendan O'Dea <bod@debian.org> | no | debian | 2005-12-16 | |
| debian/doc_info.diff | Replace generic man(1) instructions with Debian-specific information. Indicate that the user needs to install the perl-doc package. |
Brendan O'Dea <bod@debian.org> | no | 2005-03-18 | ||
| debian/enc2xs_inc.diff | Tweak enc2xs to follow symlinks and ignore missing @INC directories. - ignore missing directories, - follow symlinks (/usr/share/perl/5.8 -> 5.8.4). - filter "." out when running "enc2xs -C", it's unnecessary and causes issues with follow => 1 (see #603686 and [rt.cpan.org #64585]) |
Brendan O'Dea <bod@debian.org> | no | debian | 2005-03-08 | |
| debian/errno_ver.diff | Remove Errno version check due to upgrade problems with long-running processes. Remove version check which can cause problems for long running processes embedding perl when upgrading to a newer version, compatible, but built on a different machine. |
Brendan O'Dea <bod@debian.org> | no | debian | 2005-12-16 | |
| debian/libperl_embed_doc.diff | Note that libperl-dev package is required for embedded linking | Brendan O'Dea <bod@debian.org> | no | debian | 2005-03-08 | |
| fixes/respect_umask.diff | Respect umask during installation This is needed to satisfy Debian policy regarding group-writable site directories. |
Brendan O'Dea <bod@debian.org> | no | 2005-03-08 | ||
| debian/writable_site_dirs.diff | Set umask approproately for site install directories Policy requires group writable site directories |
Brendan O'Dea <bod@debian.org> | no | 2005-03-08 | ||
| debian/extutils_set_libperl_path.diff | EU:MM: set location of libperl.a under /usr/lib The Debian packaging moves libperl.a a couple of levels up from the CORE directory to match other static libraries. |
Niko Tyni <ntyni@debian.org> | no | 2014-05-10 | ||
| debian/no_packlist_perllocal.diff | Don't install .packlist or perllocal.pod for perl or vendor | Brendan O'Dea <bod@debian.org> | no | 2005-03-08 | ||
| debian/fakeroot.diff | Postpone LD_LIBRARY_PATH evaluation to the binary targets. Modify the setting of LD_LIBRARY_PATH to append pre-existing values at the time the rule is evaluated rather than when the Makefile is created. This is required when building packages with dpkg-buildpackage and fakeroot, since fakeroot (which now sets LD_LIBRARY_PATH) is not used for the "build" rule where the Makefile is created, but is for the clean/binary* targets. |
Brendan O'Dea <bod@debian.org> | no | 2005-03-18 | ||
| debian/instmodsh_doc.diff | Debian policy doesn't install .packlist files for core or vendor. | Brendan O'Dea <bod@debian.org> | no | 2005-03-08 | ||
| debian/ld_run_path.diff | Remove standard libs from LD_RUN_PATH as per Debian policy. | Brendan O'Dea <bod@debian.org> | no | 2005-03-18 | ||
| debian/libnet_config_path.diff | Set location of libnet.cfg to /etc/perl/Net as /usr may not be writable. | Brendan O'Dea <bod@debian.org> | no | 2005-03-08 | ||
| debian/perlivp.diff | Make perlivp skip include directories in /usr/local On Sat, Jan 10, 2009 at 12:37:18AM +1100, Brendan O'Dea wrote: > On Wed, Jan 7, 2009 at 12:21 AM, Niko Tyni <ntyni@debian.org> wrote: > > We could create the directories in a postinst script, but I'm not sure > > I see the point. They will be created automatically when installing > > CPAN modules. > > The directories are intentionally not created, as this way they are > excluded from the search path at start-up, saving a bunch of wasted > stats at use/require time in the common case that the user has not > installed any local packages. As Niko points out, they will be > created as required. |
Niko Tyni <ntyni@debian.org> | no | debian | 2009-01-09 | |
| debian/squelch-locale-warnings.diff | Squelch locale warnings in Debian package maintainer scripts The system locales are rather frequently out of sync with the C library during package upgrades, causing a huge amount of useless Perl locale warnings. Squelch them when running package maintainer scripts, detected by the DPKG_RUNNING_VERSION environment variable. Any real locale problem will show up after the system upgrade too, and the warning will be triggered normally again at that point. |
Niko Tyni <ntyni@debian.org> | no | debian | 2010-10-03 | |
| debian/patchlevel.diff | List packaged patches in patchlevel.h The list of packaged patches is in patchlevel-debian.h, which is generated from the debian/patches/ directory when building the package. |
Niko Tyni <ntyni@debian.org> | no | debian | vendor | 2011-05-15 |
| fixes/document_makemaker_ccflags.diff | Document that CCFLAGS should include $Config{ccflags} Compiling XS extensions without $Config{ccflags} can break the binary interface on some platforms. |
Niko Tyni <ntyni@debian.org> | yes | debian upstream | 2011-05-30 | |
| debian/find_html2text.diff | Configure CPAN::Distribution with correct name of html2text If you use cpan from Debian you usually wind up trying to read online documentation through it. Unfortunately cpan can't find the html2text.pl script even though it is installed using the Debian package 'html2text'. Please see the attached patch for a quick fix of this issue. [Maintainer's note: html2text in Debian is not the same implementation as the html2text.pl which is expected, but should provide similar functionality]. |
Andreas Marschke <andreas.marschke@googlemail.com> | no | debian | 2011-09-17 | |
| debian/perl5db-x-terminal-emulator.patch | Invoke x-terminal-emulator rather than xterm in perl5db.pl In Debian systems, xterm might not exist or might not be the preferred terminal emulator. Use x-terminal-emulator instead |
Dominic Hargreaves <dom@earth.li> | not-needed | debian | 2012-04-14 | |
| debian/cpan-missing-site-dirs.diff | Fix CPAN::FirstTime defaults with nonexisting site dirs if a parent is writable The site directories do not exist on a typical Debian system. The build systems will create them when necessary, so there's no need for a prompt suggesting local::lib if the first existing parent directory is writable. Also, writability of the core directories is not interesting as we explicitly tell CPAN not to touch those with INSTALLDIRS=site. |
Niko Tyni <ntyni@debian.org> | no | debian | 2012-10-16 | |
| fixes/memoize_storable_nstore.diff | Memoize::Storable: respect 'nstore' option not respected Memoize(3perl) says: tie my %cache => 'Memoize::Storable', $filename, 'nstore'; memoize 'function', SCALAR_CACHE => [HASH => \%cache]; Include the ‘nstore’ option to have the "Storable" database written in ‘network order’. (See Storable for more details about this.) In fact the "nstore" option does no such thing. Option parsing looks like this: @options{@_} = (); $self->{OPTIONS}{'nstore'} is accordingly set to undef. Later Memoize::Storable checks if the option is true, and since undef is not true, the "else" branch is always taken. if ($self->{OPTIONS}{'nstore'}) { Storable::nstore($self->{H}, $self->{FILENAME}); } else { Storable::store($self->{H}, $self->{FILENAME}); } Correcting the condition to (exists $self->{OPTIONS}{'nstore'}) fixes it. Noticed because git-svn, which uses the 'nstore' option for its on-disk caches, was producing Byte order is not compatible at ../../lib/Storable.pm when run using a perl with a different integer size (and hence byteorder). Reported by Tim Retout (RT#77790) |
Jonathan Nieder <jrnieder@gmail.com> | yes | debian upstream | 2012-07-27 | |
| debian/makemaker-pasthru.diff | Pass LD settings through to subdirectories [rt.cpan.org #28632] fixed most issues with passing LD down to subdirectory Makefile.PL files. However, there are some distributions (including Wx, Par::Packer, and Verilog-Perl) that explicitly set LD. Those still can't be overridden from the command line. Adding LD to the PASTHRU list fixes this. |
Niko Tyni <ntyni@debian.org> | no | debian | 2014-08-24 | |
| debian/makemaker-manext.diff | Make EU::MakeMaker honour MANnEXT settings in generated manpage headers This was inherited from early changes by Brendan O'Dea, previously (accidentally) in debian/prefix_changes.diff and before that in debian/extutils_hacks.diff |
Niko Tyni <ntyni@debian.org> | no | debian | 2015-07-01 | |
| debian/kfreebsd-softupdates.diff | Work around Debian Bug#796798 kFreeBSD 10 (possibly only with softupdates enabled) may defer calculating the mtime for more than 2 seconds. Work around this with a stat() call to calculate the mtime immediately. (Modified to only stat() on kfreebsd by Niko Tyni) |
Steven Chamberlain <steven@pyro.eu.org> | no | debian | 2015-12-17 | |
| fixes/memoize-pod.diff | Fix POD errors in Memoize | Dominic Hargreaves <dom@cpan.org> | yes | upstream | 2016-02-06 | |
| debian/hurd-softupdates.diff | Fix t/op/stat.t failures on hurd We already do this on GNU/kFreeBSD, and GNU/Hurd seems to need same treatment. |
Niko Tyni <ntyni@debian.org> | no | debian | 2016-04-28 | |
| fixes/math_complex_doc_great_circle.diff | Math::Trig: clarify definition of great_circle_midpoint | Dominic Hargreaves <dom@earth.li> | yes | debian upstream | 2016-04-30 | |
| fixes/math_complex_doc_see_also.diff | Math::Trig: add missing SEE ALSO | Dominic Hargreaves <dom@earth.li> | yes | debian upstream | 2016-04-30 | |
| fixes/math_complex_doc_angle_units.diff | Math::Trig: document angle units | Dominic Hargreaves <dom@earth.li> | yes | debian upstream | 2016-04-30 | |
| fixes/cpan_web_link.diff | CPAN: Add link to main CPAN web site | Dominic Hargreaves <dom@earth.li> | yes | debian upstream | 2016-04-30 | |
| debian/hppa_op_optimize_workaround.diff | Temporarily lower the optimization of op.c on hppa due to gcc-6 problems This fixes a crash in ext/XS-APItest/t/customop.t It's currently unclear if the problem is with the code or the gcc-6 optimizer. |
Niko Tyni <ntyni@debian.org> | no | debian | 2016-09-25 | |
| debian/installman-utf8.diff | Generate man pages with UTF-8 characters This fixes totally incorrectly rendered manual pages like perlunicook and perltw. |
Niko Tyni <ntyni@debian.org> | no | debian | 2016-11-19 | |
| debian/hppa_opmini_optimize_workaround.diff | Lower the optimization level of opmini.c on hppa This further amends debian/hppa_op_optimize_workaround.diff to affect miniperl too. |
Niko Tyni <ntyni@debian.org> | yes | debian upstream | 2017-07-29 | |
| debian/sh4_op_optimize_workaround.diff | Also lower the optimization level of op.c and opmini.c on sh4 This amends debian/hppa_op_optimize_workaround.diff debian/hppa_opmini_optimize_workaround.diff |
Niko Tyni <ntyni@debian.org> | no | debian | 2017-07-29 | |
| debian/perldoc-pager.diff | Fix perldoc terminal escapes when sensible-pager is less This is a temporary fix while upstream is reworking the pager handling. |
Niko Tyni <ntyni@debian.org> | yes | debian upstream | 2017-10-13 | |
| debian/prune_libs.diff | Prune the list of libraries wanted to what we actually need. We want to keep the dependencies on perl-base as small as possible, and some of the original list may be present on buildds (see Bug#128355). (Backported to metaconfig unit probes by Niko Tyni) |
Brendan O'Dea <bod@debian.org> | no | debian | 2005-03-18 | |
| debian/mod_paths.diff | Tweak @INC ordering for Debian Our order is: etc (Debian specific, for config files) site (5.8.1) vendor (all) core in perl-base (Debian specific, via APPLLIB_EXP) core (5.8.1) site (version-indep) site (pre-5.8.1) The rationale being that an admin (via site), or module packager (vendor) can chose to shadow core modules when there is a newer version than is included in core. (later updates by Niko Tyni) |
Brendan O'Dea <bod@debian.org> | no | 2005-03-18 | ||
| debian/deprecate-with-apt.diff | Point users to Debian packages of deprecated core modules | Dominic Hargreaves <dom@earth.li> | no | debian | 2010-05-17 | |
| debian/disable-stack-check.diff | Disable debugperl stack extension checks for binary compatibility with perl When an XS module is built without -DDEBUGGING but the interpreter is, the debugging stack high-water mark checking on the interpreter side doesn't work properly. This makes /usr/bin/debugperl less useful than it could be as it can no longer use many XS module packages. Patch the check away for now. We hope upstream will provide a Configure option for this in the future. |
Niko Tyni <ntyni@debian.org> | yes | debian upstream | 2018-07-16 | |
| debian/perlbug-editor.diff | Use "editor" as the default perlbug editor, as per Debian policy | Niko Tyni <ntyni@debian.org> | no | debian | 2019-02-24 | |
| debian/eu-mm-perl-base.diff | Suppress an ExtUtils::MakeMaker warning about our non-default @INC Config.pm gets loaded from a different path than archlibexp on Debian. |
Niko Tyni <ntyni@debian.org> | no | debian | 2020-06-06 | |
| fixes/io_socket_ip_ipv6.diff | Disable getaddrinfo(3) AI_ADDRCONFIG for localhost and IPv4 numeric addresses I_ADDRCONFIG can be a bad default for systems with a dual protocol loopback device but just IPv6 connectivity. In such a case, getaddrinfo(3) on 127.0.0.1 or 0.0.0.0 will fail with EAI_ADDRFAMILY even though the loopback device is able to handle them. |
Niko Tyni <ntyni@debian.org> | yes | 2020-07-04 | ||
| debian/usrmerge-lib64.diff | Configure / libpth.U: Do not adjust glibpth when /usr/lib64 is present. This results in differing values when built on a usrmerge system. [Niko Tyni: Debian systems have /lib64/ld-linux-x86-64.so.2 and nothing else, so but so called "usrmerged" systems with symlinks like /lib64 -> /usr/lib64 would trigger the unnecessary addition of both in glibpth.] |
Vagrant Cascadian <vagrant@reproducible-builds.org> | no | debian | 2021-07-15 | |
| debian/usrmerge-realpath.diff | Configure / libpth.U: use realpath --no-symlinks on Debian This makes the libpth probe results identical on usrmerged (/lib -> /usr/lib etc.) vs. non-usrmerged systems. |
Niko Tyni <ntyni@debian.org> | no | debian | 2021-08-24 | |
| debian/configure-regen.diff | Regenerate Configure et al. after probe unit changes | Niko Tyni <ntyni@debian.org> | no | debian | 2021-08-25 | |
| fixes/x32-io-msg-skip.diff | Skip io/msg.t on x32 due to broken System V message queues | Niko Tyni <ntyni@debian.org> | no | debian | 2021-08-26 | |
| debian/hurd-eumm-workaround.diff | Work around a MakeMaker regression breaking GNU/Hurd hint files The idiom of do './hints/linux.pl' or die $@; broke with https://github.com/Perl-Toolchain-Gang/ExtUtils-MakeMaker/pull/367 which made $self a lexical variable so it is no longer visible in a file loaded with 'do'. This silently makes the loaded Linux hints a no-op, leading to missing symbols, broken modules and test failures in at least NDBM_File and ODBM_File on GNU/Hurd, as reported by Samuel Thibault in https://bugs.debian.org/1018289 . The replacement of eval `cat hints/linux.pl` is not very sophisticated but should be enough for this, and alternatives seem overly verbose. The ExtUtils::MakeMaker change will be reverted in a future release, and this patch can be dropped after that. |
Niko Tyni <ntyni@debian.org> | yes | debian upstream | 2022-08-31 | |
| fixes/json-pp-warnings.diff | Call unimport first to silence warnings Trivially backported to JSON-PP 4.07 (as shipped with Perl 5.36) by Niko Tyni <ntyni@debian.org> |
Kenichi Ishigaki <ishigaki@cpan.org> | yes | debian upstream | backport, https://github.com/makamaka/JSON-PP/pull/79 | 2022-10-09 |
| fixes/readline-stream-errors.diff | only clear the stream error state in readline() for glob() This would previously clear the stream error state in any case where sv_gets() failed and the error state was set. This included normal files, which meant that the fact that an error occurred was no longer reflected in the stream state. For reads from ARGV this was a no-op, since nextargv() re-opens the input stream by calling do_open6() which closes the old input stream silently. For glob() (and really only for miniperl, since File::Glob is used for a full perl) leaving the stream in an error state could be confusing for the error reporting done when do_close() fails, since it would fail if the stream has an error state, but we report it as the underlying pclose() failing due to the child process failing in some way. Since this now leaves the error state on the stream, the close() calls in the test updated by this commit would fail, changing its output. Since the result of those closes didn't seem related to the purpose of the test, I changed it not throw an error on either close() failing. |
Tony Cook <tony@develop-help.com> | yes | debian upstream | backport, https://github.com/Perl/perl5/commit/80c1f1e45e8ef8c27d170fae7ade41971fe20218 | 2022-08-16 |
| fixes/readline-stream-errors-test.diff | test that <> doesn't clear the stream error state | Tony Cook <tony@develop-help.com> | yes | debian upstream | backport, https://github.com/Perl/perl5/commit/0b602161d2f4c5e6b22144e9f8b9f8128a35f440 | 2022-08-18 |
| fixes/lto-test-fix.diff | skip checking categorization of libperl symbols for LTO builds For LTO builds with gcc and clang the PL_no_mem symbol as listed by nm is flagged as "D" (writable data) and "T" (text, aka code) respectively. Looking at the final generated executable PL_no_mem does end up in the .rodata (read only data) section, so it might be worth adding a separate test for that. Fixes #20518 |
Tony Cook <tony@develop-help.com> | yes | debian upstream | backport, https://github.com/Perl/perl5/commit/69b4fa321bd1c6357cd9687eef887d23ac009ab0 | 2022-11-23 |
| fixes/CVE-2023-47038.diff | Fix read/write past buffer end: perl-security#140 A package name may be specified in a \p{...} regular expression construct. If unspecified, "utf8::" is assumed, which is the package all official Unicode properties are in. By specifying a different package, one can create a user-defined property with the same unqualified name as a Unicode one. Such a property is defined by a sub whose name begins with "Is" or "In", and if the sub wishes to refer to an official Unicode property, it must explicitly specify the "utf8::". S_parse_uniprop_string() is used to parse the interior of both \p{} and the user-defined sub lines. In S_parse_uniprop_string(), it parses the input "name" parameter, creating a modified copy, "lookup_name", malloc'ed with the same size as "name". The modifications are essentially to create a canonicalized version of the input, with such things as extraneous white-space stripped off. I found it convenient to strip off the package specifier "utf8::". To to so, the code simply pretends "lookup_name" begins just after the "utf8::", and adjusts various other values to compensate. However, it missed the adjustment of one required one. This is only a problem when the property name begins with "perl" and isn't "perlspace" nor "perlword". All such ones are undocumented internal properties. What happens in this case is that the input is reparsed with slightly different rules in effect as to what is legal versus illegal. The problem is that "lookup_name" no longer is pointing to its initial value, but "name" is. Thus the space allocated for filling "lookup_name" is now shorter than "name", and as this shortened "lookup_name" is filled by copying suitable portions of "name", the write can be to unallocated space. The solution is to skip the "utf8::" when reparsing "name". Then both "lookup_name" and "name" are effectively shortened by the same amount, and there is no going off the end. This commit also does white-space adjustment so that things align vertically for readability. This can be easily backported to earlier Perl releases. |
Karl Williamson <khw@cpan.org> | no | debian | backport, https://github.com/Perl/perl5/commit/7047915eef37fccd93e7cd985c29fe6be54650b6 | 2023-09-09 |
| fixes/CVE-2024-56406.diff | CVE-2024-56406: Heap-buffer-overflow with tr// This was due to underallocating needed space. If the translation forces something to become UTF-8 that is initially bytes, that UTF-8 could now require two bytes where previously a single one would do. (cherry picked from commit f93109c8a6950aafbd7488d98e112552033a3686) commit 4ff211d2bd05db0ba9e18faf1ff8bd3dab128c5a |
Karl Williamson <khw@cpan.org> | no | 2024-12-18 | ||
| fixes/CVE-2023-31484.diff | Add verify_SSL=>1 to HTTP::Tiny to verify https server identity (Trivial backport for Debian Perl 5.36 by Niko Tyni <ntyni@debian.org>) |
Stig Palmquist <git@stig.io> | yes | debian upstream | backport, https://github.com/andk/cpanpm/commit/9c98370287f4e709924aee7c58ef21c85289a7f0 | 2023-02-28 |
| fixes/CVE-2025-40909-metaconfig.diff | Check for fdopendir | "H.Merijn Brand" <perl5@tux.freedom.nl> | yes | debian upstream | backport, https://github.com/Perl/metaconfig/commit/0a72a5cecd3e17abe67be61dd2916b6d0cb6f398 | 2025-06-03 |
| fixes/CVE-2025-40909-1.diff | CVE-2025-40909: Clone dirhandles without fchdir This uses fdopendir and dup to dirhandles. This means it won't change working directory during thread cloning, which prevents race conditions that can happen if a third thread is active at the same time. (cherry picked from commit 918bfff86ca8d6d4e4ec5b30994451e0bd74aba9) |
Leon Timmermans <fawaka@gmail.com> | yes | debian upstream | backport, https://github.com/Perl/perl5/commit/84be063eb88c5b1dd26cb4c418b94d39e60b7049 | 2025-05-23 |
| fixes/CVE-2025-40909-2.diff | Minor corrections to 1f9097b342e0e37d619dfab6ea82ea99611b30bf (cherry picked from commit d19a96bcde20e2c6d237c843120d4a2dda0bda6e) |
Steve Hay <steve.m.hay@googlemail.com> | yes | debian upstream | backport, https://github.com/Perl/perl5/commit/b088e97848411fcff31efe817397985da30a664d | 2025-06-01 |
| fixes/CVE-2025-40909-3.diff | Use PerlLIO_dup_cloexec in Perl_dirp_dup to set O_CLOEXEC dup doesn't mark the new descriptor as close-on-exec, which can lead to a descriptor leaking to the new process. (cherry picked from commit d6f09a896842e5288af5d3817756b67a919ad7ad) |
Leon Timmermans <fawaka@gmail.com> | yes | debian upstream | backport, https://github.com/Perl/perl5/commit/08dffa08a0a3822d9eaae5bd7aea9c3a5b67a3f3 | 2025-06-09 |
| fixes/CVE-2025-40909-metaconfig-update.diff | Update generated files for fdopendir Although Configure and config_h.SH are originally generated files, they were changed upstream before changing the generator (metaconfig). The resulting orderings don't quite match. Also update uconfig* files, which are generated from config_h.SH et al. |
Niko Tyni <ntyni@debian.org> | no | 2025-06-27 | ||
| fixes/CVE-2026-8376-tests.diff | perl/perl-security#147: test cases The suggested case from the ticket and an alternative. (Backported for Debian by Niko Tyni) (Backported for Debian bookworm by Arnaud Rebillout) |
Tony Cook <tony@develop-help.com> | no | debian | backport, https://github.com/Perl/perl5/commit/e842efdafe7c51a687a4907e4887988fe6a025ef | 2026-05-12 |
| fixes/CVE-2026-8376.diff | perl/perl-security#147: test against the actual character lengths (Backported for Debian by Niko Tyni) (Backported for Debian bookworm by Arnaud Rebillout) |
Tony Cook <tony@develop-help.com> | no | debian | backport, https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c | 2026-05-12 |
| fixes/CVE-2026-57432-1.diff | pp_pack.c: Avoid ssize_t overflow when calculating the size of a structure If the user has requested a size that would overflow a SSize_t, then the only sensible thing to do is throw an exception, because the structure this implies couldn't possibly fit into memory anyway. (Backported for Debian by Niko Tyni) |
Paul LeoNerd Evans <leonerd@leonerd.org.uk> | yes | debian upstream | backport, https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55 | 2026-05-09 |
| fixes/CVE-2026-57432-2.diff | pp_pack.c: Avoid some other potential overflows when calculating sizes (Backported for Debian by Niko Tyni) |
Paul LeoNerd Evans <leonerd@leonerd.org.uk> | yes | debian upstream | backport, https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e | 2026-05-11 |
| fixes/CVE-2026-57433.diff | Storable.xs: Avoid signed int overflow when unpacking a list of hook data items (Backported for Debian by Niko Tyni) |
Paul LeoNerd Evans <leonerd@leonerd.org.uk> | yes | debian upstream | backport, https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7 | 2026-05-09 |
| fixes/CVE-2026-7010.diff | CVE-2026-7010: fix for request / header smuggling Validate control headers, request uri and request method for characters that could be used in request smuggling or header injection attacks. (Backported for Debian by Niko Tyni) |
Stig <stig@stig.io> | yes | debian upstream | backport, https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/d73c7651e82ace02693842df55928b6c3ae7c38d | 2026-04-27 |
| fixes/CVE-2026-7010-tests.diff | CVE-2026-7010: add tests (Backported for Debian by Niko Tyni) |
Stig Palmquist <git@stig.io> | yes | debian upstream | backport, https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/207890b6dab21c9db314af50d63202d13f317e2a | 2026-04-27 |
| fixes/CVE-2025-15649-pre-1.diff | Use Time::Local instead of POSIX::mktime | pmqs <pmqs@cpan.org> | no | 2022-04-19 | ||
| fixes/CVE-2025-15649-pre-2.diff | read zip timestamp in localtime | pmqs <pmqs@cpan.org> | no | 2022-04-24 | ||
| fixes/CVE-2025-15649.diff | Enhance _dosToUnixTime to handle zero and invalid datetime values; add tests for edge cases. Fixes #65 (Backported for Debian by Niko Tyni) (Backported for Debian bookworm by Arnaud Rebillout) |
pmqs <pmqs@cpan.org> | yes | debian upstream | backport, https://github.com/pmqs/IO-Compress/commit/fd28c1d2374eee9811f6d0c5bddc0957abdf1da8 | 2025-10-25 |
| fixes/CVE-2025-15649-tests.diff | Add tests for handling zero and invalid datetime values in unzip functionality. Fix for #65 (Backported for Debian by Niko Tyni) (Backported for Debian bookworm by Arnaud Rebillout) |
pmqs <pmqs@cpan.org> | yes | debian upstream | backport, https://github.com/pmqs/IO-Compress/commit/739698a7b1bb6814d1aa3c4a1b81374b16a9fea5 | 2025-10-25 |
| fixes/CVE-2026-48959.diff | Fix typo in fastForward #72 (Backported for Debian by Niko Tyni) |
pmqs <pmqs@cpan.org> | yes | debian upstream | backport, https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2 | 2026-05-15 |
| fixes/CVE-2026-48962.diff | remove use of eval in globmapper. #73 (Backported for Debian by Niko Tyni) |
pmqs <pmqs@cpan.org> | yes | debian upstream | backport, https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610 | 2026-05-16 |
| fixes/CVE-2026-7017-1.diff | refuse https to http redirects by default Allow opt in via allow_downgrade (Backported for Debian by Niko Tyni) |
Olaf Alders <olaf@wundersolutions.com> | yes | debian upstream | backport, https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/84984ef3930ddd4afcf5eb83b40d3cee200739c3 | 2026-05-14 |
| fixes/CVE-2026-7017-2.diff | strip auth headers on cross-origin redirects (Backported for Debian by Niko Tyni) |
Olaf Alders <olaf@wundersolutions.com> | yes | debian upstream | backport, https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/e7a03aedf2395158f2b0d3bad2df943349227bb3 | 2026-05-14 |
| fixes/CVE-2026-7017-3.diff | Fix protocol-relative Location handling so it can't be used to bypass credential strip (Backported for Debian by Niko Tyni) |
Olaf Alders <olaf@wundersolutions.com> | yes | debian upstream | backport, https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/8f32ca89e21c3ad0422adc698fa6ad17a193f55f | 2026-05-14 |
| fixes/CVE-2026-7017-4.diff | demonstrate that https upgrade now strips credentials as it is a change of origin (Backported for Debian by Niko Tyni) |
Olaf Alders <olaf@wundersolutions.com> | yes | debian upstream | backport, https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/0d7b31e7a16281e918e68fad855ddf249209b026 | 2026-05-14 |
| fixes/CVE-2026-7017-5.diff | Add tests to cover redirects from requests providing basic auth via the URL rather than a manually set Authorization header, with and without the allow_credentialed_redirects option. (Backported for Debian by Niko Tyni) |
Olaf Alders <olaf@wundersolutions.com> | yes | debian upstream | backport, https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/d9aa62b0013abb790b3cf45340320fae475ffdb2 | 2026-05-15 |
| fixes/CVE-2026-42496-1.diff | Validate symlink and hardlink linkname in SECURE MODE (Backported for Debian by Niko Tyni) |
Stig Palmquist <stig@stig.io> | no | debian | backport, https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158 | 2026-05-21 |
| fixes/CVE-2026-42496-2.diff | Allow `..` links in secure extract in parent path (Backported for Debian by Niko Tyni, fixes a regression with the earlier change) |
Stig Palmquist <git@stig.io> | yes | debian upstream | backport, https://github.com/jib/archive-tar-new/commit/484f71ea0189ed46690f50dc7ee71d4b8bc0e70f | 2026-06-02 |
| fixes/CVE-2026-13221.diff | regcomp_study: Don't create a trie that would overflow This addresses GH #23388 The design of the trie compiling code is to batch extra long tries into smaller chunks that fit into whatever limitations there are. However, this ticket shows that that isn't always being done. In this case, a bunch of branches that have TAIL operands can be combined together, and the final TAIL is used. And the code requires that the delta between the first branch and this final TAIL fit into a 16-bit field. That is the root cause of this bug. I'm not familiar enough with the trie construction code to easily understand why the final tail needs to be used here. So this patch simply doesn't optimize a sequence of branches into a trie that would overflow. This could be revisited by someone who knows more about this than I, or earlier in the development cycle. (cherry picked from commit 03f74bbbd3a68350d926ee93d56ee4808c28c4c7) |
Karl Williamson <khw@cpan.org> | yes | debian upstream | upstream, https://github.com/Perl/perl5/commit/620e07a26ebd9dc0a398bf14eb6a2105cebd2448 | 2026-07-21 |
| fixes/CVE-2026-19487.diff | regexec.c - Fix GH 22892 - AHO-CORASICK edge case issue In some circumstances the AHO-CORASICK logic wasn't matching properly when there were two possibilities whose proper prefix matches a proper suffix of a third possibilty, and one of those possibilities was shorter than the other. This was because we were NOT resetting the 'failed' flag properly. This bug must be rare because it took more than a decade for anyone to notice. This patch fixes the problem by resetting the failed flag after a successful transition. A good example of this problem is as follows: "ABCDE" =~ m/ABCF|BCDE|C/ This should match 'BCDE' and not 'C'. Because of the flag issue we were matching 'C' instead. This fixes https://github.com/Perl/perl5/issues/22892 (Backported to Debian 5.40 by Niko Tyni) |
Yves Orton <demerphq@gmail.com> | yes | debian upstream | backport, https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb | 2025-02-07 |
| fixes/CVE-2026-12087.diff | cpan/Socket - Update to version 2.041 2.041 2026-03-26 [CHANGES] * Modernise Pod documentation formatting [BUGFIXES] * Fix reuse of `STRLEN len` variable in pack_ip_mreq_source() (Backported to Debian 5.40 by Niko Tyni,including removal of the $VERSION increment) (Backported to Debian bookworm by Arnaud Rebillout) |
Paul LeoNerd Evans <leonerd@leonerd.org.uk> | no | debian | backport, https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb | 2026-05-04 |
All known versions for source package 'perl'
- 5.44.0-1 (experimental)
- 5.42.3-1 (forky, sid)
- 5.40.1-6+deb13u1 (trixie)
- 5.36.0-7+deb12u4 (bookworm-security)
- 5.36.0-7+deb12u3 (bookworm)