Security update for perl

SUSE Security Update: Security update for perl
Announcement ID: SUSE-SU-2018:1972-2
Rating: important
References: #1068565 #1082216 #1082233 #1082234 #1096718
Cross-References: CVE-2018-12015 CVE-2018-6797 CVE-2018-6798 CVE-2018-6913
Affected Products:
  • SUSE Linux Enterprise Server 12-SP2-BCL

An update that solves four vulnerabilities and has one errata is now available.

Description:

This update for perl fixes the following issues:
These security issue were fixed:

  • CVE-2018-6913: Fixed space calculation issues in pp_pack.c (bsc#1082216).
  • CVE-2018-6798: Fixed heap buffer overflow in regexec.c (bsc#1082233).
  • CVE-2018-6797: Fixed sharp-s regexp overflow (bsc#1082234).
  • CVE-2018-12015: The Archive::Tar module allowed remote attackers to bypass a directory-traversal protection mechanism and overwrite arbitrary files (bsc#1096718)

This non-security issue was fixed:
  • fix debugger crash in tab completion with Term::ReadLine::Gnu [bsc#1068565]

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Linux Enterprise Server 12-SP2-BCL:
    zypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2018-1328=1

Package List:

  • SUSE Linux Enterprise Server 12-SP2-BCL (noarch):
    • perl-doc-5.18.2-12.14.1
  • SUSE Linux Enterprise Server 12-SP2-BCL (x86_64):
    • perl-32bit-5.18.2-12.14.1
    • perl-5.18.2-12.14.1
    • perl-base-5.18.2-12.14.1
    • perl-base-debuginfo-5.18.2-12.14.1
    • perl-debuginfo-32bit-5.18.2-12.14.1
    • perl-debuginfo-5.18.2-12.14.1
    • perl-debugsource-5.18.2-12.14.1

References: