openSUSE Security Update: Security update for perl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:3101-1 Rating: moderate References: #1047178 #1057721 #1057724 #999735 Cross-References: CVE-2017-12837 CVE-2017-12883 CVE-2017-6512 Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for perl fixes the following issues: Security issues fixed: - CVE-2017-12837: Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write) via a regular expression with a '\N{}' escape and the case-insensitive modifier. (bnc#1057724) - CVE-2017-12883: Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\N{U+...}' escape. (bnc#1057721) - CVE-2017-6512: Race condition in the rmtree and remove_tree functions in the File-Path module before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving directory-permission loosening logic. (bnc#1047178) Bug fixes: - backport set_capture_string changes from upstream (bsc#999735) - reformat baselibs.conf as source validator workaround This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2017-1304=1 - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-1304=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.3 (i586 x86_64): perl-5.18.2-9.1 perl-base-5.18.2-9.1 perl-base-debuginfo-5.18.2-9.1 perl-debuginfo-5.18.2-9.1 perl-debugsource-5.18.2-9.1 - openSUSE Leap 42.3 (x86_64): perl-32bit-5.18.2-9.1 perl-base-32bit-5.18.2-9.1 perl-base-debuginfo-32bit-5.18.2-9.1 perl-debuginfo-32bit-5.18.2-9.1 - openSUSE Leap 42.3 (noarch): perl-doc-5.18.2-9.1 - openSUSE Leap 42.2 (i586 x86_64): perl-5.18.2-6.3.1 perl-base-5.18.2-6.3.1 perl-base-debuginfo-5.18.2-6.3.1 perl-debuginfo-5.18.2-6.3.1 perl-debugsource-5.18.2-6.3.1 - openSUSE Leap 42.2 (x86_64): perl-32bit-5.18.2-6.3.1 perl-base-32bit-5.18.2-6.3.1 perl-base-debuginfo-32bit-5.18.2-6.3.1 perl-debuginfo-32bit-5.18.2-6.3.1 - openSUSE Leap 42.2 (noarch): perl-doc-5.18.2-6.3.1 References: https://www.suse.com/security/cve/CVE-2017-12837.html https://www.suse.com/security/cve/CVE-2017-12883.html https://www.suse.com/security/cve/CVE-2017-6512.html https://bugzilla.suse.com/1047178 https://bugzilla.suse.com/1057721 https://bugzilla.suse.com/1057724 https://bugzilla.suse.com/999735