Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in Perl
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in Perl
ID: USN-3625-1
Distribution: Ubuntu
Plattformen: Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 17.10
Datum: Mo, 16. April 2018, 17:19
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8853
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6185
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6798
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6797
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6512
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6913
Applikationen: Perl

Originalnachricht

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============3944600984949555557==
Content-Type: multipart/signed; micalg=pgp-sha512;
protocol="application/pgp-signature";
boundary="toaUlegDk4us3lhBq7dEivjg55uMXDznl"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--toaUlegDk4us3lhBq7dEivjg55uMXDznl
Content-Type: multipart/mixed;
boundary="UaRcVXOgRb3UkTz98sJFE0ndd3L6NunlN";
protected-headers="v1"
From: Marc Deslauriers <marc.deslauriers@canonical.com>
Reply-To: Ubuntu Security <security@ubuntu.com>
To: ubuntu-security-announce@lists.ubuntu.com
Message-ID: <4713110c-cb5c-2508-7c2d-9f3070d853ef@canonical.com>
Subject: [USN-3625-1] Perl vulnerabilities

--UaRcVXOgRb3UkTz98sJFE0ndd3L6NunlN
Content-Type: text/plain; charset=utf-8
Content-Language: en-C
Content-Transfer-Encoding: quoted-printable

==========================================================================
Ubuntu Security Notice USN-3625-1
April 16, 2018

perl vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 17.10
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in Perl.

Software Description:
- perl: Practical Extraction and Report Language

Details:

It was discovered that Perl incorrectly handled certain regular
expressions. An attacker could possibly use this issue to cause Perl to
hang, resulting in a denial of service. This issue only affected Ubuntu
14.04 LTS. (CVE-2015-8853)

It was discovered that Perl incorrectly loaded libraries from the current
working directory. A local attacker could possibly use this issue to
execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and
Ubuntu 16.04 LTS. (CVE-2016-6185)

It was discovered that Perl incorrectly handled the rmtree and remove_tree
functions. A local attacker could possibly use this issue to set the mode
on arbitrary files. This issue only affected Ubuntu 14.04 LTS and Ubuntu
16.04 LTS. (CVE-2017-6512)

Brian Carpenter discovered that Perl incorrectly handled certain regular
expressions. An attacker could use this issue to cause Perl to crash,
resulting in a denial of service, or possibly execute arbitrary code. This
issue has only been addressed in Ubuntu 16.04 LTS and Ubuntu 17.10.
(CVE-2018-6797)

Nguyen Duc Manh discovered that Perl incorrectly handled certain regular
expressions. An attacker could use this issue to cause Perl to crash,
resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS
and Ubuntu 17.10. (CVE-2018-6798)

GwanYeong Kim discovered that Perl incorrectly handled certain data when
using the pack function. An attacker could use this issue to cause Perl to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2018-6913)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.10:
perl 5.26.0-8ubuntu1.1

Ubuntu 16.04 LTS:
perl 5.22.1-9ubuntu0.3

Ubuntu 14.04 LTS:
perl 5.18.2-2ubuntu1.4

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/usn/usn-3625-1
CVE-2015-8853, CVE-2016-6185, CVE-2017-6512, CVE-2018-6797,
CVE-2018-6798, CVE-2018-6913

Package Information:
https://launchpad.net/ubuntu/+source/perl/5.26.0-8ubuntu1.1
https://launchpad.net/ubuntu/+source/perl/5.22.1-9ubuntu0.3
https://launchpad.net/ubuntu/+source/perl/5.18.2-2ubuntu1.4


--UaRcVXOgRb3UkTz98sJFE0ndd3L6NunlN--

--toaUlegDk4us3lhBq7dEivjg55uMXDznl
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJa1LDmAAoJEGVp2FWnRL6TgS0QALRAmhglnNejPxzMc5hMUA8L
rEVmURoUpOalLg2klfUY1sc2sB/7Tu6pmiLYJf2zlYW1lnNrGPPba8IGWhPCtzDR
vTLqEQULW29eFnBoCUorRwZG7LqR1yJnIube2hndzQuv1OeCzafjSKaDvwVM0ztR
f5RnC18U3TYt25bvfVriOwaT12c+n1p6HquQEACF96l1cOR7pGiVTo3l6qIXhJH3
ibd9HLb/6D/ultedXGGlpaQDqUFLLHxUxDRxilohapz+FzcKJDYZKwDsmQ/mbg/k
7cuJoi35sDG0gZvfL2akcvhIZGfvv6UxW7EQnMSyXHtwmBoJA2nqr6L23UhSR62x
W15RGyiD8d08W+rtH2Vz592urZyrYu2eZnshx044KVEEGOM1pHOrkNyBgczpEg/q
XO/lBiFsYiFttxG2wZU3h4YgmLqRx/Otf1BczDr93DUAtzjWLoviaA+af91QfXUn
pnf19BB1uo3Ub9lc94rY72fJ+nFzXdjVhNM6w6TKFQzc1yp58uPEfnXd5ZGI8fUA
WV8ZohoK0woaBiLyR95wO0a39GZ2fB1GxZ4g/R/7shocKB42dYgLnHkdvIqcVwev
98dCt1pw8HNAIuGr4fgtDniW2FU5GFTE6S0tT394zLXB2iqfi2R8ZGh8D/BVL1td
LxwVm1rsx8Qp+a0JyxNF
=YFF5
-----END PGP SIGNATURE-----

--toaUlegDk4us3lhBq7dEivjg55uMXDznl--


--===============3944600984949555557==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

LS0gCnVidW50dS1zZWN1cml0eS1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKdWJ1bnR1LXNlY3VyaXR5
LWFubm91bmNlQGxpc3RzLnVidW50dS5jb20KTW9kaWZ5IHNldHRpbmdzIG9yIHVuc3Vic2NyaWJl
IGF0OiBodHRwczovL2xpc3RzLnVidW50dS5jb20vbWFpbG1hbi9saXN0aW5mby91YnVudHUtc2Vj
dXJpdHktYW5ub3VuY2UK

--===============3944600984949555557==--
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung