Описание
Security update for perl
This update for perl fixes the following issues:
- CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
- CVE-2026-12087:
Socket'spack_ip_mreq_source()can copy adjacent heap memory into the returned packed structure (bsc#1268349). - CVE-2026-57432: an integer overflow in
S_measure_structleads to an out-of-bounds heap read inpackandunpack(bsc#1271372).
Список пакетов
Container bci/bci-minimal:latest
Container suse/ltss/sle15.4/sle15:latest
Container suse/ltss/sle15.5/sle15:latest
Container suse/ltss/sle15.6/bci-base-fips:latest
Container suse/ltss/sle15.6/sle15:latest
Container suse/manager/4.3/proxy-httpd:latest
Container suse/manager/4.3/proxy-salt-broker:latest
Container suse/manager/4.3/proxy-squid:latest
Container suse/samba-client:latest
Container suse/sle-micro-rancher/5.3:latest
Container suse/sle-micro-rancher/5.4:latest
Container suse/sle-micro/5.3/toolbox:latest
Container suse/sle-micro/5.4/toolbox:latest
Container suse/sle-micro/5.5/toolbox:latest
Container suse/sle-micro/5.5:latest
Container suse/sle-micro/base-5.5:latest
Container suse/sle-micro/kvm-5.5:latest
Container suse/sle-micro/rt-5.5:latest
Container third-party/amd/amdgpu-driver:sles-15.7-30.20.1
Container third-party/amd/amdgpu-driver:sles-15.7-30.30.4
Container third-party/amd/amdgpu-driver:sles-15.7-31.10
Container third-party/amd/amdgpu-driver:sles-15.7-31.20
Container third-party/amd/amdgpu-driver:sles-15.7-31.30
Container third-party/amd/amdgpu-driver:sles-15.7-31.40
Container third-party/nvidia/driver:550-sles15.7
Container third-party/nvidia/driver:570-sles15.7
Container third-party/nvidia/driver:575-sles15.7
Container third-party/nvidia/driver:580-sles15.7
Container third-party/nvidia/driver:590-sles15.7
Container third-party/nvidia/driver:595-sles15.7
Image SLES15-SP7-BYOS-GCE
Image SLES15-SP7-GCE
Image SLES15-SP7-Hardened-BYOS-GCE
Image SLES15-SP7-SAP-BYOS-GCE
Image SLES15-SP7-SAP-GCE
Image SLES15-SP7-SAP-Hardened-BYOS-GCE
Image SLES15-SP7-SAP-Hardened-GCE
Image SLES15-SP7-SAPCAL-GCE
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
SUSE Linux Enterprise Micro 5.3
SUSE Linux Enterprise Micro 5.4
SUSE Linux Enterprise Micro 5.5
SUSE Linux Enterprise Module for Basesystem 15 SP7
SUSE Linux Enterprise Module for Development Tools 15 SP7
SUSE Linux Enterprise Module for Package Hub 15 SP7
SUSE Linux Enterprise Server 15 SP4-LTSS
SUSE Linux Enterprise Server 15 SP5-LTSS
SUSE Linux Enterprise Server 15 SP6-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP4
SUSE Linux Enterprise Server for SAP Applications 15 SP5
SUSE Linux Enterprise Server for SAP Applications 15 SP6
Ссылки
- Link for SUSE-SU-2026:3558-1
- E-Mail link for SUSE-SU-2026:3558-1
- SUSE Security Ratings
- SUSE Bug 1266304
- SUSE Bug 1268349
- SUSE Bug 1271372
- SUSE CVE CVE-2026-12087 page
- SUSE CVE CVE-2026-57432 page
- SUSE CVE CVE-2026-8376 page
Описание
Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.
Затронутые продукты
Ссылки
- CVE-2026-12087
- SUSE Bug 1268349
Описание
Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.
Затронутые продукты
Ссылки
- CVE-2026-57432
- SUSE Bug 1271372
Описание
Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.
Затронутые продукты
Ссылки
- CVE-2026-8376
- SUSE Bug 1266303