Perl 5.22.5
The Perl 5.22.5 release fixes numerous security problems that might allow remote attackers to execute arbitrary code with the permissions of the web server. The problems were discovered by Kwan Lau of NIST/NRC, who found a vulnerability in the handling of Common Gateway Interface (CGI) requests. This vulnerability exists because Perl's built-in CGI interface was not properly sanitized before being returned to the client. The problems can be corrected by installing this security patch.
The Perl 5.22.5 release fixes several problems in Perl's XML handling that might allow remote attackers to access and modify data in memory. The problems were discovered by Jarkko Hietaniemi of DigiCert, Inc. and were reported to the perl-security-announce mailing list. The problems are corrected by not accessing the passed XML hashref when extracting attributes from it. The problems can be corrected by applying this security patch.
The Perl 5.22.5 release fixes a flaw in the handling of certain types of HTTP status responses. The problem was discovered by Tatsuo Ishii of the National Institute of Informatics. This vulnerability exists because the status codes were not checked for incorrect values prior to being added to the list. The problems can be corrected by applying this security patch.
The Perl 5.22.5 release fixes a flaw in Perl's Unicode handling that could allow remote attackers to cause a denial of service (crash) or execute arbitrary code. The flaw exists because Unicode handling is not properly used when allocating data structures. The problems can be corrected by applying this security patch.
The Perl 5.22.5 release fixes a flaw in Perl's handling of certain types of HTTP status responses. The problem was discovered by Tatsuo Ishii of the National Institute of Informatics. This vulnerability exists because the status codes were not checked for incorrect values prior to being added to the list. The problems can be corrected by applying this security patch.
The Perl 5.22.5 release fixes a flaw in Perl's handling of certain types of HTTP
Related links:
Comments