--------------------------------------------------------------------- Fedora Legacy Test Update Notification FEDORALEGACY-2005-152845 Bugzilla https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=152845 2006-01-09 --------------------------------------------------------------------- Name : perl Versions : rh7.3: perl-5.6.1-38.0.7.3.3.legacy Versions : rh9: perl-5.8.0-90.0.12.legacy Versions : fc1: perl-5.8.3-17.4.legacy Versions : fc2: perl-5.8.3-19.3.legacy Summary : The Perl programming language. Description : Perl is a high-level programming language commonly used for system administration utilities and Web programming. --------------------------------------------------------------------- Update Information: Updated perl packages that fix several security flaws are now available. Perl is a high-level programming language commonly used for system administration utilities and Web programming. An unsafe file permission bug was discovered in the rmtree() function in the File::Path module. The rmtree() function removes files and directories in an insecure manner, which could allow a local user to read or delete arbitrary files. The Common Vulnerabilities and Exposures project has assigned the name CVE-2004-0452 to this issue. Solar Designer discovered several temporary file bugs in various Perl modules. A local attacker could overwrite or create files as the user running a Perl script that uses a vulnerable module. The Common Vulner- abilities and Exposures project has assigned the name CVE-2004-0976 to this issue. Kevin Finisterre discovered a stack based buffer overflow flaw in sperl, the Perl setuid wrapper. A local user could create a sperl executable script with a carefully created path name, overflowing the buffer and leading to root privilege escalation. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0156 to this issue. Kevin Finisterre discovered a flaw in sperl which can cause debugging information to be logged to arbitrary files. By setting an environment variable, a local user could cause sperl to create, as root, files with arbitrary filenames, or append the debugging information to existing files. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-0155 to this issue. Paul Szabo discovered a bug in the way Perl's File::Path::rmtree module removed directory trees. If a local user has write permissions to a subdirectory within the tree being removed by File::Path::rmtree, it is possible for them to create setuid binary files. The Common Vulner- abilities and Exposures project has assigned the name CVE-2005-0448 to this issue. (This issue updates CVE-2004-0452). Note that CAN-2005-0077 is referred to in the changelogs below. This vulnerability does not affect these packages, but is a vulnerability in perl-DBI packages instead. Users of perl are advised to upgrade to these packages which contain backported patches and are not vulnerable to these issues. --------------------------------------------------------------------- Changelogs rh7.3: * Tue Dec 20 2005 David Eisenstein <deisenst@xxxxxxx> 1:5.6.1-38.0.7.3.3.legacy - Add BuildRequires: byacc per John Dalbec. Bug #152835. * Sat Dec 17 2005 David Eisenstein <deisenst@xxxxxxx> 1:5.6.1-38.0.7.3.2.legacy - Add BuildRequires: db2-devel - Since this is being build in mach, we cannot use the "trick" that Red Hat used (of running rpm -q in the build process) to generate the list of files from which *.ph files are pulled. So instead, I've created two static files which list the same thing, Source11 and Source12. These two files may need to be refreshed when rebuilding again. * Fri Dec 16 2005 David Eisenstein <deisenst@xxxxxxx> 1:5.6.1-38.0.7.3.1.legacy - fix perldb5.pl (debugger) to use "$ENV{HOME}/.perldbtty$$" instead of "/var/run/perldbtty$$", per Bug #152845 comment 33. Replaces perl-5.6.1-solartmp.patch with an updated patch. * Thu Jul 14 2005 John Dalbec <jpdalbec@xxxxxxx> 1:5.6.1-38.0.7.3.legacy - integrate fix for CAN-2005-0448 * Thu Dec 9 2004 John Dalbec <jpdalbec@xxxxxxx> 1:5.6.1-37.0.7.3.legacy - integrate new tmpfile patch from OWL/solar designer - add BuildRequires: db1-devel db3-devel BuildRequires: glibc-devel gdbm-devel gpm-devel libjpeg-devel BuildRequires: libpng-devel libtiff-devel ncurses-devel popt BuildRequires: zlib-devel binutils libelf e2fsprogs-devel pam pwdb BuildRequires: rpm-devel rh9: * Thu Dec 29 2005 David Eisenstein <deisenst@xxxxxxx> 2:5.8.0-90.0.12.legacy - Add BuildRequires: libacl-devel, libcap-devel. This provides missing .ph header files sys/acl.ph and sys/capability.ph. * Fri Dec 23 2005 David Eisenstein <deisenst@xxxxxxx> 2:5.8.0-90.0.11.legacy - Add BuildRequires: byacc elfutils-devel - Since this is being build in mach, we cannot use the "trick" that Red Hat used (of running rpm -q in the build process) to generate the list of files from which *.ph files are pulled. So instead, there are two static files which list the same thing, Source13 and Source14. These two files may need to be refreshed when rebuilding again. * Sat Oct 22 2005 David Eisenstein <deisenst@xxxxxxx> 2:5.8.0-90.0.10.legacy - Update perl-5.8.0-tempfile-5.8.3-backport.patch to correct some errors. - Bugzilla #152845 * Thu Jul 14 2005 John Dalbec <jpdalbec@xxxxxxx> 2:5.8.0-90.0.9.legacy - integrate fixes for CAN-2004-0452 CAN-2005-0077 CAN-2005-0155 CAN-2005-0156 CAN-2005-0448 and a CGI.pm DoS. * Thu Dec 9 2004 John Dalbec <jpdalbec@xxxxxxx> 2:5.8.0-89.0.9.legacy - integrate tmpfile patch from OWL/solar designer - add BuildRequires: glibc-devel gdbm-devel gpm-devel libjpeg-devel BuildRequires: libpng-devel libtiff-devel ncurses-devel popt BuildRequires: zlib-devel binutils e2fsprogs-devel pam BuildRequires: rpm-devel groff fc1: * Tue Dec 27 2005 David Eisenstein <deisenst@xxxxxxx> 3:5.8.3-17.4.legacy - Added BuildRequires: byacc, groff * Sun Sep 19 2005 David Eisenstein <deisenst@xxxxxxx> 3:5.8.3-17.3.legacy - Remove patch1005: perl-5.8.3-cgi.pm.patch introduces a bug and is unnecessary. See bug # 152845 comment 9. * Tue Sep 13 2005 David Eisenstein <deisenst@xxxxxxx> 3:5.8.3-17.2.legacy - Re-do version number for FC1 release so as not to conflict with FC2. - Put whitespace back to make an easier compare with 5.8.3-16 - Remove patch for CAN-2005-0077 since it patches perl-DBI package, not this one. * Thu Jul 14 2005 John Dalbec <jpdalbec@xxxxxxx> 3:5.8.3-18.1.legacy - integrate fixes for CAN-2004-0452 CAN-2005-0077 CAN-2005-0155 CAN-2005-0156 CAN-2005-0448 and a CGI.pm DoS. * Thu Dec 9 2004 John Dalbec <jpdalbec@xxxxxxx> 3:5.8.3-17.1.legacy - integrate tmpfile patch from OWL/solar designer fc2: * Wed Dec 28 2005 David Eisenstein <deisenst@xxxxxxx> 3:5.8.3-19.3.legacy - Added BuildRequires: byacc, groff * Wed Nov 23 2005 John Dalbec <jpdalbec@xxxxxxx> 3:5.8.3-19.2.legacy - integrate tmpfile patch from OWL/solar designer - integrate fixes for CAN-2004-0452 CAN-2005-0155 CAN-2005-0156 and CAN-2005-0448. --------------------------------------------------------------------- This update can be downloaded from: http://download.fedoralegacy.org/ (sha1sums) rh73: ac3b7161e09878545dc1e499ad4d1c1de5cf8a42 redhat/7.3/updates-testing/i386/perl-5.6.1-38.0.7.3.3.legacy.i386.rpm d5d8c6c4b2b77fc14b0720dcad3c799f3dfdf759 redhat/7.3/updates-testing/i386/perl-CGI-2.752-38.0.7.3.3.legacy.i386.rpm c0a405c744e2b047fefd9e189da08f84433538d4 redhat/7.3/updates-testing/i386/perl-CPAN-1.59_54-38.0.7.3.3.legacy.i386.rpm 9380974623d1c7e9283823cc6a300c1486cb1052 redhat/7.3/updates-testing/i386/perl-DB_File-1.75-38.0.7.3.3.legacy.i386.rpm 0b1c087c7aa5d97118e84e471fe154599104260f redhat/7.3/updates-testing/i386/perl-NDBM_File-1.75-38.0.7.3.3.legacy.i386.rpm 28c36210be8c7207264fc2b55cdcedf7d1e4bb80 redhat/7.3/updates-testing/i386/perl-suidperl-5.6.1-38.0.7.3.3.legacy.i386.rpm 41fe2199272ab4d601634650be781753d391d750 redhat/7.3/updates-testing/SRPMS/perl-5.6.1-38.0.7.3.3.legacy.src.rpm rh9: d889ae85e1585e93aa76cd67edab80a2c1f0e076 redhat/9/updates-testing/i386/perl-5.8.0-90.0.12.legacy.i386.rpm 0615bbecd89001917ef70e0a60f20d5c5c50a732 redhat/9/updates-testing/i386/perl-CGI-2.81-90.0.12.legacy.i386.rpm 9b06404d6d324b322fc5f959d78d678e3dc823e9 redhat/9/updates-testing/i386/perl-CPAN-1.61-90.0.12.legacy.i386.rpm 05234d09cec06556e3208efe95363bf3b07100d1 redhat/9/updates-testing/i386/perl-DB_File-1.804-90.0.12.legacy.i386.rpm bfa538993bf4554703fd25dcb44e06a8aeb75484 redhat/9/updates-testing/i386/perl-suidperl-5.8.0-90.0.12.legacy.i386.rpm d73eb66c03bf06bea9fb861c33de5bc0484e2b9f redhat/9/updates-testing/SRPMS/perl-5.8.0-90.0.12.legacy.src.rpm fc1: 3211332bad74a6965dac37a726d46dba88adc226 fedora/1/updates-testing/i386/perl-5.8.3-17.4.legacy.i386.rpm 156099d6f6f56bd1c8a0db137e2ee3c66104771e fedora/1/updates-testing/i386/perl-suidperl-5.8.3-17.4.legacy.i386.rpm 3f5ffa320347a2cc9e98219a57a637da5e2b08f8 fedora/1/updates-testing/SRPMS/perl-5.8.3-17.4.legacy.src.rpm fc2: 6c43d3e838f4edb74a120134455990725b589b89 fedora/2/updates-testing/i386/perl-5.8.3-19.3.legacy.i386.rpm 561aa026e227438489430b8c245439fada4cc23f fedora/2/updates-testing/i386/perl-suidperl-5.8.3-19.3.legacy.i386.rpm 56cd349370c7c83e9c25b8207dd114b5169898a9 fedora/2/updates-testing/SRPMS/perl-5.8.3-19.3.legacy.src.rpm --------------------------------------------------------------------- Please test and comment in bugzilla.
Attachment:
signature.asc
Description: OpenPGP digital signature
-- fedora-legacy-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-legacy-list
