Synopsis: Moderate: perl security and bug fix update
Issue Date: 2011-05-19
CVE Numbers: CVE-2011-1487
Perl is a high-level programming language commonly used for system
administration utilities and web programming. The Perl CGI module
provides resources for preparing and processing Common Gateway Interface
(CGI) based HTTP requests and responses.
It was found that the Perl CGI module used a hard-coded value for the
MIME boundary string in multipart/x-mixed-replace content. A remote
attacker could possibly use this flaw to conduct an HTTP response
splitting attack via a specially-crafted HTTP request. (CVE-2010-2761)
A CRLF injection flaw was found in the way the Perl CGI module processed
a sequence of non-whitespace preceded by newline characters in the
header. A remote attacker could use this flaw to conduct an HTTP
response splitting attack via a specially-crafted sequence of characters
provided to the CGI module. (CVE-2010-4410)
It was found that certain Perl string manipulation functions (such as
uc() and lc()) failed to preserve the taint bit. A remote attacker could
use this flaw to bypass the Perl taint mode protection mechanism in
scripts that use the affected functions to process tainted input.
(CVE-2011-1487)
These packages upgrade the CGI module to version 3.51. Refer to the CGI
module's Changes file, linked to in the References, for a full list of
changes.
This update also fixes the following bugs:
* When using the "threads" module, an attempt to send a signal to a
thread that did not have a signal handler specified caused the perl
interpreter to terminate unexpectedly with a segmentation fault. With
this update, the "threads" module has been updated to upstream version
1.82, which fixes this bug. As a result, sending a signal to a thread
that does not have the signal handler specified no longer causes perl to
cras
* Prior to this update, the perl packages did not require the
Digest::SHA module as a dependency. Consequent to this, when a user
started the cpan command line interface and attempted to download a
distribution from CPAN, they may have been presented with the following
message:
CPAN: checksum security checks disabled because Digest::SHA not
installed. Please consider installing the Digest::SHA module.
This update corrects the spec file for the perl package to require the
perl-Digest-SHA package as a dependency, and cpan no longer displays the
above message.
* When using the "threads" module, continual creation and destruction of
threads could cause the Perl program to consume an increasing amount of
memory. With this update, the underlying source code has been corrected
to free the allocated memory when a thread is destroyed, and the
continual creation and destruction of threads in Perl programs no longer
leads to memory leaks.
* Due to a packaging error, the perl packages did not include the
"NDBM_File" module. This update corrects this error, and "NDBM_File" is
now included as expected.
* Prior to this update, the prove(1) manual page and the "prove --help"
command listed "--fork" as a valid command line option. However, version
3.17 of the Test::Harness distribution removed the support for the
fork-based parallel testing, and the prove utility thus no longer
supports this option. This update corrects both the manual page and the
output of the "prove --help" command, so that "--fork" is no longer
included in the list of available command line options.
Users of Perl, especially those of Perl threads, are advised to upgrade
to these updated packages, which correct these issues.
SL6:
x86_64
perl-Archive-Extract-0.38-119.el6.x86_64.rpm
perl-ExtUtils-CBuilder-0.27-119.el6.x86_64.rpm
perl-ExtUtils-Embed-1.28-119.el6.x86_64.rpm
perl-ExtUtils-MakeMaker-6.55-119.el6.x86_64.rpm
perl-ExtUtils-ParseXS-2.2003.0-119.el6.x86_64.rpm
perl-File-Fetch-0.26-119.el6.x86_64.rpm
perl-IO-Compress-Base-2.020-119.el6.x86_64.rpm
perl-IO-Compress-Zlib-2.020-119.el6.x86_64.rpm
perl-IO-Zlib-1.09-119.el6.x86_64.rpm
perl-IPC-Cmd-0.56-119.el6.x86_64.rpm
perl-Digest-SHA-5.47-119.el6.x86_64.rpm
perl-devel-5.10.1-119.el6.i686.rpm
perl-Archive-Tar-1.58-119.el6.x86_64.rpm
perl-CGI-3.51-119.el6.x86_64.rpm
perl-Compress-Raw-Zlib-2.023-119.el6.x86_64.rpm
perl-Compress-Zlib-2.020-119.el6.x86_64.rpm
perl-core-5.10.1-119.el6.x86_64.rpm
perl-CPAN-1.9402-119.el6.x86_64.rpm
perl-CPANPLUS-0.88-119.el6.x86_64.rpm
perl-debuginfo-5.10.1-119.el6.i686.rpm
perl-debuginfo-5.10.1-119.el6.x86_64.rpm
perl-libs-5.10.1-119.el6.i686.rpm
perl-libs-5.10.1-119.el6.x86_64.rpm
perl-Locale-Maketext-Simple-0.18-119.el6.x86_64.rpm
perl-Parse-CPAN-Meta-1.40-119.el6.x86_64.rpm
perl-Pod-Escapes-1.04-119.el6.x86_64.rpm
perl-Pod-Simple-3.13-119.el6.x86_64.rpm
perl-suidperl-5.10.1-119.el6.x86_64.rpm
perl-Term-UI-0.20-119.el6.x86_64.rpm
perl-Test-Harness-3.17-119.el6.x86_64.rpm
perl-Test-Simple-0.92-119.el6.x86_64.rpm
perl-Time-HiRes-1.9721-119.el6.x86_64.rpm
perl-Time-Piece-1.15-119.el6.x86_64.rpm
perl-parent-0.221-119.el6.x86_64.rpm
perl-Package-Constants-0.02-119.el6.x86_64.rpm
perl-Log-Message-0.02-119.el6.x86_64.rpm
perl-Log-Message-Simple-0.04-119.el6.x86_64.rpm
perl-Module-Build-0.3500-119.el6.x86_64.rpm
perl-Module-CoreList-2.18-119.el6.x86_64.rpm
perl-Module-Load-0.16-119.el6.x86_64.rpm
perl-Module-Load-Conditional-0.30-119.el6.x86_64.rpm
perl-Module-Loaded-0.02-119.el6.x86_64.rpm
perl-Module-Pluggable-3.90-119.el6.x86_64.rpm
perl-Object-Accessor-0.34-119.el6.x86_64.rpm
perl-version-0.77-119.el6.x86_64.rpm
perl-5.10.1-119.el6.x86_64.rpm
perl-Params-Check-0.26-119.el6.x86_64.rpm
perl-devel-5.10.1-119.el6.x86_64.rpm
i386
perl-ExtUtils-CBuilder-0.27-119.el6.i686.rpm
perl-ExtUtils-Embed-1.28-119.el6.i686.rpm
perl-ExtUtils-MakeMaker-6.55-119.el6.i686.rpm
perl-ExtUtils-ParseXS-2.2003.0-119.el6.i686.rpm
perl-File-Fetch-0.26-119.el6.i686.rpm
perl-IO-Compress-Base-2.020-119.el6.i686.rpm
perl-IO-Compress-Zlib-2.020-119.el6.i686.rpm
perl-IO-Zlib-1.09-119.el6.i686.rpm
perl-IPC-Cmd-0.56-119.el6.i686.rpm
perl-5.10.1-119.el6.i686.rpm
perl-Digest-SHA-5.47-119.el6.i686.rpm
perl-devel-5.10.1-119.el6.i686.rpm
perl-Archive-Extract-0.38-119.el6.i686.rpm
perl-Archive-Tar-1.58-119.el6.i686.rpm
perl-CGI-3.51-119.el6.i686.rpm
perl-Compress-Raw-Zlib-2.023-119.el6.i686.rpm
perl-Compress-Zlib-2.020-119.el6.i686.rpm
perl-core-5.10.1-119.el6.i686.rpm
perl-CPAN-1.9402-119.el6.i686.rpm
perl-CPANPLUS-0.88-119.el6.i686.rpm
perl-debuginfo-5.10.1-119.el6.i686.rpm
perl-libs-5.10.1-119.el6.i686.rpm
perl-Locale-Maketext-Simple-0.18-119.el6.i686.rpm
perl-parent-0.221-119.el6.i686.rpm
perl-Pod-Escapes-1.04-119.el6.i686.rpm
perl-Pod-Simple-3.13-119.el6.i686.rpm
perl-suidperl-5.10.1-119.el6.i686.rpm
perl-Term-UI-0.20-119.el6.i686.rpm
perl-Test-Harness-3.17-119.el6.i686.rpm
perl-Test-Simple-0.92-119.el6.i686.rpm
perl-Time-HiRes-1.9721-119.el6.i686.rpm
perl-Time-Piece-1.15-119.el6.i686.rpm
perl-Parse-CPAN-Meta-1.40-119.el6.i686.rpm
perl-Params-Check-0.26-119.el6.i686.rpm
perl-Package-Constants-0.02-119.el6.i686.rpm
perl-Log-Message-0.02-119.el6.i686.rpm
perl-Log-Message-Simple-0.04-119.el6.i686.rpm
perl-Module-Build-0.3500-119.el6.i686.rpm
perl-Module-CoreList-2.18-119.el6.i686.rpm
perl-Module-Load-0.16-119.el6.i686.rpm
perl-Module-Load-Conditional-0.30-119.el6.i686.rpm
perl-Module-Loaded-0.02-119.el6.i686.rpm
perl-Module-Pluggable-3.90-119.el6.i686.rpm
perl-Object-Accessor-0.34-119.el6.i686.rpm
perl-version-0.77-119.el6.i686.rpm
- Scientific Linux Development Team
|
