openSUSE Security Update: Security update for perl ______________________________________________________________________________
Announcement ID: openSUSE-SU-2017:3101-1 Rating: moderate References: #1047178 #1057721 #1057724 #999735 Cross-References: CVE-2017-12837 CVE-2017-12883 CVE-2017-6512
Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2 ______________________________________________________________________________
An update that solves three vulnerabilities and has one errata is now available.
Description:
This update for perl fixes the following issues:
Security issues fixed: - CVE-2017-12837: Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write) via a regular expression with a '\N{}' escape and the case-insensitive modifier. (bnc#1057724) - CVE-2017-12883: Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\N{U+...}' escape. (bnc#1057721) - CVE-2017-6512: Race condition in the rmtree and remove_tree functions in the File-Path module before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving directory-permission loosening logic. (bnc#1047178)
Bug fixes: - backport set_capture_string changes from upstream (bsc#999735) - reformat baselibs.conf as source validator workaround
This update was imported from the SUSE:SLE-12:Update update project.
Patch Instructions:
To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product:
- openSUSE Leap 42.3:
zypper in -t patch openSUSE-2017-1304=1
- openSUSE Leap 42.2:
zypper in -t patch openSUSE-2017-1304=1
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE Leap 42.3 (i586 x86_64):
perl-5.18.2-9.1 perl-base-5.18.2-9.1 perl-base-debuginfo-5.18.2-9.1 perl-debuginfo-5.18.2-9.1 perl-debugsource-5.18.2-9.1
- openSUSE Leap 42.3 (x86_64):
perl-32bit-5.18.2-9.1 perl-base-32bit-5.18.2-9.1 perl-base-debuginfo-32bit-5.18.2-9.1 perl-debuginfo-32bit-5.18.2-9.1
- openSUSE Leap 42.3 (noarch):
perl-doc-5.18.2-9.1
- openSUSE Leap 42.2 (i586 x86_64):
perl-5.18.2-6.3.1 perl-base-5.18.2-6.3.1 perl-base-debuginfo-5.18.2-6.3.1 perl-debuginfo-5.18.2-6.3.1 perl-debugsource-5.18.2-6.3.1
- openSUSE Leap 42.2 (x86_64):
perl-32bit-5.18.2-6.3.1 perl-base-32bit-5.18.2-6.3.1 perl-base-debuginfo-32bit-5.18.2-6.3.1 perl-debuginfo-32bit-5.18.2-6.3.1
- openSUSE Leap 42.2 (noarch):
perl-doc-5.18.2-6.3.1
References:
https://www.suse.com/security/cve/CVE-2017-12837.html https://www.suse.com/security/cve/CVE-2017-12883.html https://www.suse.com/security/cve/CVE-2017-6512.html https://bugzilla.suse.com/1047178 https://bugzilla.suse.com/1057721 https://bugzilla.suse.com/1057724 https://bugzilla.suse.com/999735