Internet Bug Bounty: heap-buffer-overflow (READ of size 11) in Perl 5.25.x

This issue was first reported to the Perl security mailing list on 19 August 2016. It was inadvertently made public in another bug report on 23 August 2016. It was finally marked fixed around 23 January 2017. Original bug report: perl -e 'v300&O|0' triggers a heap-buffer-overflow in Perlmyatof2...

Config-Model Local Elevation of Privilege Vulnerability

Config-Model aka libconfig-model-perl is an open source tool for validating, migrating or editing configuration files, which can support a variety of user interfaces such as graphical and interactive commands. A security vulnerability exists in the lib/Config/Model.pm file in versions of...

DEBIAN-CVE-2017-0373

The genclasspod implementation in lib/Config/Model/Utils/GenClassPod.pm in Config-Model aka libconfig-model-perl before 2.102 has a dangerous "use lib" line, which allows remote attackers to have an unspecified impact via a crafted Debian package file...

CVE-2017-0374

lib/Config/Model.pm in Config-Model aka libconfig-model-perl before 2.102 allows local users to gain privileges via a crafted model in the current working directory, related to use of . with the INC array...

CVE-2017-0373

The genclasspod implementation in lib/Config/Model/Utils/GenClassPod.pm in Config-Model aka libconfig-model-perl before 2.102 has a dangerous "use lib" line, which allows remote attackers to have an unspecified impact via a crafted Debian package file...

CVE-2017-0373

The genclasspod implementation in lib/Config/Model/Utils/GenClassPod.pm in Config-Model aka libconfig-model-perl before 2.102 has a dangerous "use lib" line, which allows remote attackers to have an unspecified impact via a crafted Debian package file...

DEBIAN-CVE-2017-0374

lib/Config/Model.pm in Config-Model aka libconfig-model-perl before 2.102 allows local users to gain privileges via a crafted model in the current working directory, related to use of . with the INC array...

UBUNTU-CVE-2017-0373

The genclasspod implementation in lib/Config/Model/Utils/GenClassPod.pm in Config-Model aka libconfig-model-perl before 2.102 has a dangerous "use lib" line, which allows remote attackers to have an unspecified impact via a crafted Debian package file...

CVE-2017-0373

The genclasspod implementation in lib/Config/Model/Utils/GenClassPod.pm in Config-Model aka libconfig-model-perl before 2.102 has a dangerous "use lib" line, which allows remote attackers to have an unspecified impact via a crafted Debian package file...

CVE-2017-0374

Affected software/component: libconfig-model-perl (Config-Model) – the file lib/Config/Model.pm. Vulnerability: in versions before 2.102, a crafted model in the current working directory can cause local privilege elevation via the INC path mechanism (use of “.” with INC). Impact: local users can ...

CVE-2017-0373

Config-Model (libconfig-model-perl) before 2.102 contains a dangerous "use lib" line in GenClassPod.pm that could let remote attackers influence the system via a crafted Debian package. This CVE-2017-0373 detail is consistently described across multiple feeds (NVD, CNVD, OSV, Ubuntu, Debian OSV, ...

[SECURITY] Fedora 26 Update: pcre-8.40-7.fc26

PCRE, Perl-compatible regular expression, library has its own native API, b ut a set of wrapper functions that are based on the POSIX API are also supplied in the libpcreposix library. Note that this just provides a POSIX calling interface to PCRE: the regular expressions themselves still follow...

[SECURITY] Fedora 25 Update: pcre2-10.23-6.fc25

PCRE2 is a re-working of the original PCRE Perl-compatible regular expression library to provide an entirely new API. PCRE2 is written in C, and it has its own API. There are three sets of functions, one for the 8-bit library, which processes strings of bytes, one for the 16-bit library, which...

[SECURITY] Fedora 24 Update: ntp-4.2.6p5-44.fc24

The Network Time Protocol NTP is used to synchronize a computer's time with another reference time source. This package includes ntpd a daemon which continuously adjusts system time and utilities used to query and configure the ntpd daemon. Perl scripts ntp-wait and ntptrace are in the ntp-perl...

Debian DLA-887-1 : libdatetime-timezone-perl new upstream version

This update includes the changes in tzdata 2017b for the Perl bindings. For the list of changes, see DLA-886-1. For Debian 7 'Wheezy', these problems have been fixed in version 1:1.58-1+2017b. We recommend that you upgrade your libdatetime-time zone-perl packages. NOTE: Tenable Network Security h...

[SECURITY] [DLA 887-1] libdatetime-timezone-perl new upstream version

Package : libdatetime-timezone-perl Version : 1:1.58-1+2017b This update includes the changes in tzdata 2017b for the Perl bindings. For the list of changes, see DLA-886-1. For Debian 7 "Wheezy", these problems have been fixed in version 1:1.58-1+2017b. We recommend that you upgrade your...

DLA-887-1 libdatetime-timezone-perl - new upstream version

Bulletin has no description...

[SECURITY] Fedora 26 Update: ntp-4.2.8p10-1.fc26

The Network Time Protocol NTP is used to synchronize a computer's time with another reference time source. This package includes ntpd a daemon which continuously adjusts system time and utilities used to query and configure the ntpd daemon. Perl scripts are in the ntp-perl package, ntpdate is in...

[SECURITY] Fedora 25 Update: ntp-4.2.6p5-44.fc25

The Network Time Protocol NTP is used to synchronize a computer's time with another reference time source. This package includes ntpd a daemon which continuously adjusts system time and utilities used to query and configure the ntpd daemon. Perl scripts ntp-wait and ntptrace are in the ntp-perl...

PCRE 'pcre32_copy_substring' function buffer overflow vulnerability (CNVD-2017-04912)

PCRE Perl Compatible Regular Expressions is a software developer Philip Hazel developed a use of C language written in open source regular expression library. A buffer overflow vulnerability exists in the 'pcre32copysubstring' function in the pcreget.c file of libpcre1 in PCRE version 8.40. A...