{"id":"openSUSE-SU-2026:22226-1","summary":"Security update for perl-MIME-tools","details":"This update for perl-MIME-tools fixes the following issues:\n\nChanges in perl-MIME-tools:\n\n- updated to 5.522.0 (5.522)\n  * 5.522\n\t* VERSION 5.522 RELEASED\n\t* Many security issues were addressed (see the following ten CVEs)\n\t  Issues were brought to my attention, and patches supplied, by the\n\t  CPANSec security group.\n\t* parse_params: flag a parameter list that could not be parsed\n\t  Detect additional ambiguous parse situations when parameter\n\t  names contain illegal characters.  Fixes:\n\t  CVE-2026-116264 invalid parameter hides boundary/filename. bsc#1288723\n\t* parse_params: check the boundary after RFC 2231 reassembly\n\t  Another ambiguous-parse case was missed (trailing space after\n\t  boundary was not detected for RFC-2231-encoded boundaries.)  Fixes:\n\t  CVE-2026-116265 RFC 2231 boundary skips ambiguity checks. bsc#1288722\n\t* parse_params: Stricter checking for encoded boundaries; earlier\n\t  versions would miss some cases.  Fixes:\n\t  CVE-2026-116266 boundary changed by decoding not flagged. bsc#1288721\n\t* Cap the indentation levels in the Results: structure.  Otherwise,\n\t  specially-crafted messages could consume large amounts of memory.\n\t  Fixes: CVE-2026-116267 indent stored per message per level bsc#1288720\n\t* parse_params: stop a comment match at the next parenthesis.\n\t  Otherwise, specially-crafted messages could cause the regex\n\t  back-tracker to consume large amounts of CPU time.  Note that\n\t  MIME::Parser does not correctly parse ((nested comments)) and\n\t  has never done so.  Fixes:\n\t  CVE-2026-116268 unclosed \"(\" comments backtrack CPU exhaustion. bsc#1288719\n\t* parse_params: re-encode filename* values without charset tricks\n\t  Specially-crafted messages could trick recommended_filename()\n\t  into returning an empty string instead of a plausible filename.\n\t  Fixes: CVE-2026-116269 RFC 2231 language tag empties filename. bsc#1288718\n\t* decode_mimewords: do not copy the input into each error.  Otherwise,\n\t  specially-crafted messages could consume large amounts of memory.\n\t  Fixes: CVE-2026-116270 each bad \"=?\" copies the input into $@. bsc#1288717\n\t* FileUnder: do not reuse an existing generated directory.  Otherwise,\n\t  attackers might be able to use symbolic links to get files created\n\t  in unexpected locations.  Fixes:\n\t  CVE-2026-116271 FileUnder reuses a pre-created directory. bsc#1288716\n\t* parse_params: flag comments other readers do not skip\n\t  Specially-crafted messages could create ambiguous messages without\n\t  setting the ambiguous_parse flag.  Fixes:\n\t  CVE-2026-116272  comment hides a duplicate boundary. bsc#1288715\n\t* Call whine() rather than error() if max_parts or max_depth is\n\t  exceeded during a parse.  This lets us return undef rather than\n\t  throwing an exception if ignore_errors() is set to 0.\n\t* Change to defaults: max_parts is now set to 1000 and max_depth\n\t  to 64 rather than being unlimited.  This should not affect most\n\t  real-world uses of MIME::tools, but you may need to increase\n\t  these values or set them to -1 (unlimited) if you run into trouble.\n\t      ***** NOTE INCOMPATIBILITY *****\n\t  Fixes: CVE-2026-116273 max_parts and max_depth unlimited. bsc#1288714\n\t* Do not signal an ambiguous parse if we have filename=\"\" or\n\t  name=\"\"\n\t* Update author names in META.yml\n\t* Add git repo to META.yml\n  * 5.520\n\t* VERSION 5.520 RELEASED\n\t* MIME::Parser used O(N^2) CPU time and memory parsing a MIME\n\t  message nested N levels deep.  A smallish specially-crafted\n\t  message could DOS the computer by making it consume enormous\n\t  amounts of memory and CPU time.  The parser was modified to use\n\t  O(N) time and memory in this case.  Additionally, a new\n\t  MIME::Parser::max_depth() function was added to limit the nesting\n\t  depth before declaring a parse failure.  Problem was reported to\n\t  me by Zhaoyang Li and Xiang Li from AOSP Lab at Nankai University.\n\t* MIME::Parser would ignore multiple blank lines in a message\n\t  preamble when parsing it; this could break DKIM.  Problem pointed\n\t  out and fix suggested by Tim Henderson.\n\t* If a MIME boundary includes trailing whitespace, we mark the\n\t  parse as ambiguous.  Problem noted and patch submitted by\n\t  Christian Herdtweck\n  * 5.519\n\t* VERSION 5.519 RELEASED\n\t* Some (buggy) software creates base64-encoded parts as a\n\t  concatenation of multiple base64-encoded streams, and some client\n\t  software decodes each stream separately and concatenates the\n\t  results.  Duplicate this behavior in MIME::tools to prevent it\n\t  from being used as a mechanism to sneak dangerous content past a\n\t  security scanner.  Patch courtesy of Giorgio Premi\n\t  \u003cgiosh94mhz@gmail.com\u003e.\n\n- updated to 5.518.0 (5.518)\n  * 5.518\n\t* VERSION 5.518 RELEASED\n\t* Add tests for encoded \"boundary=XXX\" parameters and set\n\t  the ambiguous-parse flag if any are found.  Patch courtesy\n\t  of Dominik Csapak \u003cd.csapak@proxmox.com\u003e\n\t  MIME::tools chooses to decode encoded boundary parameters.\n\t  MUA behaviors differ; Claws-Mail decodes them while Thunderbird\n\t  does not.\n\t* Don't ignore invalid whitespace after \"boundary=XXX\" parameter.\n\t  Patch courtesy of Dominik Csapak \u003cd.csapak@proxmox.com\u003e\n\t* Ignore comments between tokens.  A header parameter can be\n\t  written foo(comment)=bar and it's the same as foo=bar.\n\t  Patch courtesy of Dominik Csapak \u003cd.csapak@proxmox.com\u003e\n\n- updated to 5.517.0 (5.517)\n  * 5.517\n\t* VERSION 5.517 RELEASED\n\t* Add a missing test message file that was causing tests to fail.\n  * 5.516\n\t* VERSION 5.516 RELEASED\n\t* Handle MIME parameters of the form param= better (ie,\n\t  a parameter with no value at all.)  It's treated the\n\t  same as param=\"\" rather than aborting the parse.\n\t* Diagnose additional types of malformed MIME as ambiguous.\n\t  Specifically, an empty boundary parameters like boundary= or\n\t  boundary=\"\" is treated as ambiguous.  Thanks to Stoiko Ivanov\n\t  \u003cs.ivanov@proxmox.com\u003e for pointing out this missing case.\n","modified":"2026-11-04T14:15:29.468997774Z","published":"2026-11-03T18:16:30Z","related":["CVE-2026-116264","CVE-2026-116265","CVE-2026-116266","CVE-2026-116267","CVE-2026-116268","CVE-2026-116269","CVE-2026-116270","CVE-2026-116271","CVE-2026-116272","CVE-2026-116273"],"upstream":["CVE-2026-116264","CVE-2026-116265","CVE-2026-116266","CVE-2026-116267","CVE-2026-116268","CVE-2026-116269","CVE-2026-116270","CVE-2026-116271","CVE-2026-116272","CVE-2026-116273"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1288714"},{"type":"REPORT","url":"https://bugzilla.suse.com/1288715"},{"type":"REPORT","url":"https://bugzilla.suse.com/1288716"},{"type":"REPORT","url":"https://bugzilla.suse.com/1288717"},{"type":"REPORT","url":"https://bugzilla.suse.com/1288718"},{"type":"REPORT","url":"https://bugzilla.suse.com/1288719"},{"type":"REPORT","url":"https://bugzilla.suse.com/1288720"},{"type":"REPORT","url":"https://bugzilla.suse.com/1288721"},{"type":"REPORT","url":"https://bugzilla.suse.com/1288722"},{"type":"REPORT","url":"https://bugzilla.suse.com/1288723"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-116264"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-116265"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-116266"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-116267"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-116268"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-116269"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-116270"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-116271"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-116272"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-116273"}],"affected":[{"package":{"name":"perl-MIME-tools","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/perl-MIME-tools&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.522.0-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"perl-MIME-tools":"5.522.0-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22226-1.json"}}],"schema_version":"1.9.2"}