Debian dla-4821 : libperl-dev - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dla-4821. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(362949);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/05");

  script_cve_id(
    "CVE-2025-15649",
    "CVE-2026-7010",
    "CVE-2026-7017",
    "CVE-2026-8376",
    "CVE-2026-12087",
    "CVE-2026-13221",
    "CVE-2026-19487",
    "CVE-2026-42496",
    "CVE-2026-42497",
    "CVE-2026-48959",
    "CVE-2026-48962",
    "CVE-2026-57432",
    "CVE-2026-57433"
  );
  script_xref(name:"IAVA", value:"2026-A-0618");
  script_xref(name:"IAVA", value:"2026-A-0696-S");
  script_xref(name:"IAVA", value:"2026-A-0889");

  script_name(english:"Debian dla-4821 : libperl-dev - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dla-4821 advisory.

    - -------------------------------------------------------------------------
    Debian LTS Advisory DLA-4821-1                [email protected]
    https://www.debian.org/lts/security/                     Arnaud Rebillout
    October 05, 2026                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : perl
    Version        : 5.36.0-7+deb12u4
    CVE ID         : CVE-2025-15649 CVE-2026-7010 CVE-2026-7017 CVE-2026-8376
                     CVE-2026-12087 CVE-2026-13221 CVE-2026-19487 CVE-2026-42496
                     CVE-2026-42497 CVE-2026-48959 CVE-2026-48962 CVE-2026-57432
                     CVE-2026-57433
    Debian Bug     : 1137345 1138854 1138856 1138858 1138859 1138860 1138863
                     1138905 1138906 1140152 1141639 1142037 1144668

    Multiple vulnerabilities were discovered in the Perl programming language.

    CVE-2025-15649

        header parsing in IO::Uncompress::Unzip

        IO::Uncompress::Unzip versions before 2.215 for Perl propagate
        uncaught exception when parsing zip header with malformed DOS date.
        _dosToUnixTime() decodes the local-file-header last-modification date
        field and calls Time::Local::timelocal() without an eval guard. A
        header whose date field decodes to an out-of-range month, day, or
        hour causes timelocal() to die. The exception propagates out of
        IO::Uncompress::Unzip->new($file) where callers expect undef plus
        $UnzipError.

    CVE-2026-7010

        CRLF-validation in HTTP::Tiny

        HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in
        HTTP request lines or control field header values. The unvalidated
        inputs are the method and URI in the request line, the URL host that
        becomes the `Host:` header, and HTTP/1.1 control data field values.
        An attacker who controls one of these inputs, for example a user
        supplied URL passed to a webhook or URL fetch endpoint, can inject
        additional headers and smuggle requests to the upstream server.

    CVE-2026-7017

        HTTP::Tiny credential forwarding on redirects

        HTTP::Tiny versions before 0.095 for Perl forward credential headers
        to cross-origin redirect targets. When the server returns a 3xx
        redirect, `_maybe_redirect` follows the `Location:` header and
        `_prepare_headers_and_cb` re-merges the caller's `headers` argument
        into the new request, without checking whether the redirect target
        shares an origin with the original URL. Caller-supplied
        `Authorization`, `Cookie` and `Proxy-Authorization` headers are
        therefore re-sent to whatever host the redirect names, across scheme,
        host or port boundaries, and including `https` to `http` downgrades
        that expose them in plaintext on the wire. The HTTP::Tiny POD note
        that Authorization headers will not be included in a redirected
        request applied only to the URL-userinfo Basic-auth path, not to
        headers passed explicitly by the caller.

    CVE-2026-8376

        Buffer overflow in Perl_study_chunk

        Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from
        5.43.0 before 5.43.11 have a heap buffer overflow when compiling
        regular expressions with a repeated fixed string on 32-bit builds.
        Perl_study_chunk in regcomp_study.c checked the size of the joined
        substring buffer in characters rather than bytes. For a quantified
        fixed substring with a large minimum count, the byte length mincount
        * l could overflow SSize_t, producing an undersized SvGROW
        allocation; the subsequent copy writes past the end of the buffer. A
        caller that compiles an attacker-controlled regular expression on a
        32-bit perl build triggers a heap buffer overflow at compile time.

    CVE-2026-12087

        Socket: pack_ip_mreq_source() out-of-bounds heap read

        Socket versions before 2.041 for Perl have an out-of-bounds heap
        read. In Socket.xs, pack_ip_mreq_source() checks the length of its
        source argument before the argument is read, so the check tests the
        byte length carried over from the preceding multiaddr argument
        instead. Both addresses occupy a 4-byte field, so a valid multiaddr
        lets a source of any length pass the check, and the source is then
        copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A
        source shorter than 4 bytes is not rejected, and the copy reads up to
        3 bytes past the end of its buffer. Calling pack_ip_mreq_source()
        with a source value shorter than 4 bytes copies adjacent heap memory
        into the returned packed structure.

    CVE-2026-13221

        silently incorrect regular expression matches

        Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from
        5.43.0 before 5.43.10 produce silently incorrect regular expression
        matches when an alternation of more than 65535 fixed string branches
        is compiled into a trie in Perl_study_chunk. When such branches are
        combined into a trie, the delta between the first branch and the
        shared tail is stored in a 16-bit field. A branch count above 65535
        overflows the field, and the trie's match decision table is truncated
        with no warning or error. A pattern of this shape produces false
        positive matches (matching strings it should not) and false negative
        matches (failing to match strings it should). When such a pattern
        gates an access or filtering decision, the result is wrong.

    CVE-2026-19487

        incorrect regular expression match results

        Perl versions from 5.9.4 before 5.41.9 produce incorrect regular
        expression match results when a stale failure flag ends the
        Aho-Corasick prescan early in S_find_byclass. The prescan walks the
        subject for positions where the full pattern could match, and the
        engine tries it from the leftmost one recorded. A failing transition
        sets the failed flag, and a later successful transition does not
        clear it, so the prescan reads the stale flag as a failure and stops
        before it can record a candidate that starts earlier. It takes a
        subject where one candidate is recorded and a later character then
        forces a fallback through a fail link that succeeds. Example: ABCDE
        =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE ABCDE =~
        m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this
        can miss input it should match, or match it on the wrong branch, so
        an access or filtering decision made from the result can be wrong.

    CVE-2026-42496

        Archive::Tar symlink extraction

        Archive::Tar versions before 3.08 for Perl extract symlinks with
        attacker controlled targets outside the extraction directory.
        _make_special_file() passes the tar header's linkname to symlink()
        without validating it against absolute paths or .. segments. The
        secure-extract mode check that guards regular file extraction does
        not cover the symlink target. A subsequent open through the extracted
        name reads or writes the attacker chosen path.

    CVE-2026-42497

        Archive::Tar hardlink extraction

        Archive::Tar versions before 3.08 for Perl extract hardlinks to
        attacker controlled paths outside the extraction directory.
        _make_special_file() passes the tar header's linkname to link()
        without validating it against absolute paths or .. segments, creating
        a hardlink that shares the victim file's inode. A subsequent write
        through the extracted name modifies the victim file, and the
        post-extraction chmod, chown, and utime block in _extract_file()
        (guarded only against symlinks via -l) applies the tar header's mode,
        owner, and timestamps to the shared inode during extraction alone.

    CVE-2026-48959

        CPU exhaustion in IO::Uncompress::Unzip

        IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU
        exhaustion via per-byte read loop in fastForward. fastForward()
        compares length $offset (the digit count of the offset, 1 to 19)
        against the chunk size $c instead of $offset itself, so $c shrinks
        from 16 KiB to 1-19 bytes per iteration. Extracting a named entry
        from an attacker supplied zip via IO::Uncompress::Unzip->new($zip,
        Name => $target) drives a per-byte read loop scaling with the entry's
        compressed size, up to the non-Zip64 4 GiB cap.

    CVE-2026-48962

        code execution in IO-Compress via output globs

        IO::Compress versions before 2.220 for Perl can execute arbitrary
        code in File::GlobMapper via an attacker-controlled output glob.
        _parseOutputGlob() wraps the caller-supplied output glob string in
        double quotes and stores it in the parser state; _getFiles() then
        runs the stored expression through eval STRING. A literal double
        quote in the output glob closes the dquote wrapper, and the
        characters that follow are evaluated as Perl. Arbitrary Perl in the
        output glob executes at the calling process's privilege.

    CVE-2026-57432

        out of bound heap reads in pack() and unpack()

        Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from
        5.43.0 before 5.43.11 have an integer overflow in S_measure_struct
        leading to an out-of-bounds heap read in pack and unpack.
        S_measure_struct adds each item's size times its repeat count to a
        running total with no overflow check, so a large repeat count in a
        pack or unpack template wraps the signed SSize_t total negative. The
        @, X, and x position codes then guard their moves with a signed
        length comparison that passes when the length is negative, advancing
        the buffer pointer out of bounds. A template derived from untrusted
        input can read heap memory past the buffer and return it to the
        caller.

    CVE-2026-57433

        signed integer overflow in Storable

        Storable versions before 3.41 for Perl have a signed integer overflow
        when deserializing a crafted SX_HOOK record. retrieve_hook_common
        reads a signed 32-bit item count from an SX_HOOK record and calls
        av_extend with that count plus one. A count of I32_MAX wraps the
        addition to a negative value. A crafted blob passed to thaw or
        retrieve triggers the overflow; av_extend receives the negative count
        and dies with a panic, terminating the deserialization.

    For Debian 12 bookworm, these problems have been fixed in version
    5.36.0-7+deb12u4.

    We recommend that you upgrade your perl packages.

    For the detailed security status of perl please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/perl

    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/perl");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2025-15649");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-12087");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-13221");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-19487");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-42496");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-42497");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-48959");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-48962");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-57432");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-57433");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-7010");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-7017");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-8376");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bookworm/perl");
  script_set_attribute(attribute:"solution", value:
"Upgrade the libperl-dev packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-8376");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/05");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libperl-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libperl5.36");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:perl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:perl-base");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:perl-debug");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:perl-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:perl-modules-5.36");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(12)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 12.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '12.0', 'prefix': 'libperl-dev', 'reference': '5.36.0-7+deb12u4'},
    {'release': '12.0', 'prefix': 'libperl5.36', 'reference': '5.36.0-7+deb12u4'},
    {'release': '12.0', 'prefix': 'perl', 'reference': '5.36.0-7+deb12u4'},
    {'release': '12.0', 'prefix': 'perl-base', 'reference': '5.36.0-7+deb12u4'},
    {'release': '12.0', 'prefix': 'perl-debug', 'reference': '5.36.0-7+deb12u4'},
    {'release': '12.0', 'prefix': 'perl-doc', 'reference': '5.36.0-7+deb12u4'},
    {'release': '12.0', 'prefix': 'perl-modules-5.36', 'reference': '5.36.0-7+deb12u4'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libperl-dev / libperl5.36 / perl / perl-base / perl-debug / perl-doc / etc');
}