[SECURITY] Fedora 42 Update: perl-String-Compare-ConstantTime-0.321-22.fc42

This module provides one function, "equals", which works like perl's "eq", but which does not provide a timing side-channel. Such comparison is useful when matching against a secret string...

openSUSE 15 Security Update : perl-Data-Entropy (openSUSE-SU-2025:0123-1)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2025:0123-1 advisory. Updated to 0.8.0 0.008: see /usr/share/doc/packages/perl-Data-Entropy/Changes Version 0.008; 2025-03-27: Use Crypt::URandom to seed the default algorithm...

Fedora 40 : perl-String-Compare-ConstantTime (2025-e6f5710dba)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-e6f5710dba advisory. This release fixes CVE-2024-13939 leaking the length of a secret string Tenable has extracted the preceding description block directly from the Fedo...

Fedora 41 : perl-String-Compare-ConstantTime (2025-5d61874568)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-5d61874568 advisory. This release fixes CVE-2024-13939 leaking the length of a secret string Tenable has extracted the preceding description block directly from the Fedo...

perl-32bit-5.40.2-1.1 on GA media (moderate)

perl-32bit-5.40.2-1.1 on GA media Announcement ID: openSUSE-SU-2025:15003-1 Rating: moderate Cross-References: CVE-2024-56406 CVSS scores: CVE-2024-56406 SUSE : 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2024-56406 SUSE : 8.6 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA...

OPENSUSE-SU-2025:0123-1 Security update for perl-Data-Entropy

This update for perl-Data-Entropy fixes the following issues: Updated to 0.8.0 0.008: see /usr/share/doc/packages/perl-Data-Entropy/Changes Version 0.008; 2025-03-27: Use Crypt::URandom to seed the default algorithm with cryptographically secure random bytes instead of the builtin rand function...

PT-2025-36474

Name of the Vulnerable Software and Affected Versions: Cpanel::JSON::XS versions prior to 4.40 Description: Cpanel::JSON::XS, a Perl module, contains an integer buffer overflow. This overflow occurs when parsing specially crafted JSON data, leading to a segmentation fault. This can result in...

Fedora 41 : perl-Crypt-URandom-Token / perl-DBIx-Class-EncodedColumn (2025-0a8c805972)

The remote Fedora 41 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-0a8c805972 advisory. Needed for perl-DBIx-Class-EncodedColumn-0.11 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

FreeBSD : Perl -- heap buffer overflow when transliterating non-ASCII bytes (a380f43e-19e5-11f0-9568-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a380f43e-19e5-11f0-9568-b42e991fc52e advisory. 9b29abf9-4ab0-4765-b253-1875cd9b441e reports: A heap buffer overflow vulnerability was discovered in...

OPENSUSE-SU-2025:15003-1 perl-32bit-5.40.2-1.1 on GA media

These are all security issues fixed in the perl-32bit-5.40.2-1.1 package on the GA media of openSUSE Tumbleweed...

Security update for perl-Data-Entropy (moderate)

openSUSE Security Update: Security update for perl-Data-Entropy Announcement ID: openSUSE-SU-2025:0123-1 Rating: moderate References: 1240395 Cross-References: CVE-2025-1860 Affected Products: openSUSE Backports SLE-15-SP6 An update that fixes one vulnerability is now available. Description: This...

[SECURITY] Fedora 41 Update: perl-DBIx-Class-EncodedColumn-0.11000-1.fc41

This DBIx::Class component can be used to automatically encode a column's...

SUSE CVE-2025-2814

Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. This issue affects operating systems where "/dev/urandom'" is unavailable. In that case, Crypt::CBC will fallback to u...

Security Bulletin: IBM Automation Decision Services - Multiple CVEs addressed (February 2024)

Summary IBM Automation Decision Services is vulnerable to denial of service attacks in third party and open source used in the product for various functions. See full list below. This vulnerability has been addressed. Vulnerability Details CVEID:CVE-2023-36054 DESCRIPTION: MIT Kerberos 5 aka krb5...

Ubuntu: Security Advisory (USN-7434-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 22.04 LTS / 24.04 LTS / 24.10 : Perl vulnerability (USN-7434-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7434-1 advisory. It was discovered that Perl incorrectly handled transliterating non-ASCII bytes. A remote attacker could use this issue to cause Perl to crash...

Slackware: Security Advisory (SSA:2025-104-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[slackware-security] perl

New perl packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/perl-5.34.3-i586-1slack15.0.txz: Upgraded. This update fixes bugs and a security issue: Heap-buffer-overflow with tr// Also upgraded Pe...

CVE-2024-56406

A flaw was found in Perl. This vulnerability allows a heap buffer overflow, which can lead to denial of service and potential arbitrary code execution on platforms that lack sufficient defenses via specially crafted input to the tr/// transliteration operator containing non-ASCII bytes on the...

USN-7434-1 perl vulnerability

It was discovered that Perl incorrectly handled transliterating non-ASCII bytes. A remote attacker could use this issue to cause Perl to crash, resulting in a denial of service, or possibly execute arbitrary code...