rpm package
opensuse/perl&distro=openSUSE Leap 16.0
pkg:rpm/opensuse/perl&distro=openSUSE%20Leap%2016.0
Vulnerabilities (5)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-57432 | Hig | 8.4 | < 5.42.0-160000.3.1 | 5.42.0-160000.3.1 | Jul 13, 2026 | Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpa | |
| CVE-2026-13221 | Cri | 9.1 | < 5.42.0-160000.3.1 | 5.42.0-160000.3.1 | Jul 13, 2026 | Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the sh | |
| CVE-2026-12087 | Cri | 9.1 | < 5.42.0-160000.3.1 | 5.42.0-160000.3.1 | Jun 15, 2026 | Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both ad | |
| CVE-2025-15649 | Med | 5.5 | < 5.42.0-160000.3.1 | 5.42.0-160000.3.1 | May 27, 2026 | IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose | |
| CVE-2026-8376 | Cri | 9.8 | < 5.42.0-160000.3.1 | 5.42.0-160000.3.1 | May 26, 2026 | Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed |
- affected < 5.42.0-160000.3.1fixed 5.42.0-160000.3.1
Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpa
- affected < 5.42.0-160000.3.1fixed 5.42.0-160000.3.1
Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the sh
- affected < 5.42.0-160000.3.1fixed 5.42.0-160000.3.1
Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both ad
- affected < 5.42.0-160000.3.1fixed 5.42.0-160000.3.1
IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose
- affected < 5.42.0-160000.3.1fixed 5.42.0-160000.3.1
Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed