{"id":"USN-8675-2","summary":"perl vulnerabilities","details":"USN-8675-1 fixed vulnerabilities in Perl. This update provides the\ncorresponding fix for Perl on Ubuntu 26.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that Perl incorrectly handled short source addresses\n in the Socket module. An attacker could possibly use this issue to\n trigger an out-of-bounds heap read, resulting in information disclosure.\n (CVE-2026-12087)\n\n It was discovered that Perl incorrectly handled regular expressions\n containing a large number of fixed string alternatives. An attacker\n could possibly use this issue to cause incorrect regular expression\n matches, resulting in security restrictions being bypassed.\n (CVE-2026-13221)\n\n It was discovered that Perl incorrectly handled certain large repeat\n counts when processing pack and unpack templates. An attacker could\n possibly use this issue to trigger an out-of-bounds heap read, resulting\n in information disclosure. (CVE-2026-57432)\n\n It was discovered that Perl incorrectly handled certain crafted data\n when deserializing with the Storable module. An attacker could possibly\n use this issue to trigger an integer overflow and application\n termination, resulting in a denial of service. (CVE-2026-57433)","modified":"2026-09-10T00:57:22.504844549Z","published":"2026-09-09T14:10:59Z","related":["UBUNTU-CVE-2026-12087","UBUNTU-CVE-2026-13221","UBUNTU-CVE-2026-57432","UBUNTU-CVE-2026-57433"],"upstream":["CVE-2026-12087","CVE-2026-13221","CVE-2026-57432","CVE-2026-57433","UBUNTU-CVE-2026-12087","UBUNTU-CVE-2026-13221","UBUNTU-CVE-2026-57432","UBUNTU-CVE-2026-57433"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8675-2"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-12087"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-13221"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-57432"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-57433"}],"affected":[{"package":{"name":"perl","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/perl?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.40.1-7ubuntu0.3"}]}],"versions":["5.40.1-6build1","5.40.1-7build1","5.40.1-7ubuntu0.1","5.40.1-7ubuntu0.2"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"libperl5.40","binary_version":"5.40.1-7ubuntu0.3"},{"binary_version":"5.40.1-7ubuntu0.3","binary_name":"perl"},{"binary_name":"perl-base","binary_version":"5.40.1-7ubuntu0.3"},{"binary_version":"5.40.1-7ubuntu0.3","binary_name":"perl-debug"},{"binary_version":"5.40.1-7ubuntu0.3","binary_name":"perl-modules-5.40"}]},"database_specific":{"cves_map":{"cves":[{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2026-12087"},{"id":"CVE-2026-13221","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-57432","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}]},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-57433"}],"ecosystem":"Ubuntu:26.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8675-2.json"}}],"schema_version":"1.9.0"}