Home / mailings

PDF

[USN-8675-2] Perl vulnerabilities

Posted on 09 September 2026
Ubuntu Security

==========================================================================Ubuntu Security Notice USN-8675-2
September 09, 2026

perl vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS

Summary:

Several security issues were fixed in Perl.

Software Description:
- perl: Practical Extraction and Report Language

Details:

USN-8675-1 fixed vulnerabilities in Perl. This update provides the
corresponding fix for Perl on Ubuntu 26.04 LTS.

Original advisory details:

It was discovered that Perl incorrectly handled short source addresses
in the Socket module. An attacker could possibly use this issue to
trigger an out-of-bounds heap read, resulting in information disclosure.
(CVE-2026-12087)

It was discovered that Perl incorrectly handled regular expressions
containing a large number of fixed string alternatives. An attacker
could possibly use this issue to cause incorrect regular expression
matches, resulting in security restrictions being bypassed.
(CVE-2026-13221)

It was discovered that Perl incorrectly handled certain large repeat
counts when processing pack and unpack templates. An attacker could
possibly use this issue to trigger an out-of-bounds heap read, resulting
in information disclosure. (CVE-2026-57432)

It was discovered that Perl incorrectly handled certain crafted data
when deserializing with the Storable module. An attacker could possibly
use this issue to trigger an integer overflow and application
termination, resulting in a denial of service. (CVE-2026-57433)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
libperl5.40 5.40.1-7ubuntu0.3
perl-base 5.40.1-7ubuntu0.3
perl-modules-5.40 5.40.1-7ubuntu0.3

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-8675-2
https://ubuntu.com/security/notices/USN-8675-1
CVE-2026-12087, CVE-2026-13221, CVE-2026-57432, CVE-2026-57433

Package Information:
https://launchpad.net/ubuntu/+source/perl/5.40.1-7ubuntu0.3

--===============4186288806594373956==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature

 

TOP