[From nobody Sun Aug 16 13:03:08 2026 Received: (at submit) by bugs.debian.org; 16 Aug 2026 07:33:52 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-18.6 required=4.0 tests=BAYES_00, BODY_INCLUDES_PACKAGE,BODY_INCLUDES_SEVERITY,DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA,HAS_PACKAGE,HTML_MESSAGE, MULTALT,NUMONLY,SPF_HELO_PASS,SPF_PASS,VERSION autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 9; hammy, 147; neutral, 313; spammy, 3. spammytokens:0.999-+--I*:please, 0.999-+--I*:email, 0.999-+--I*:e-mail hammytokens:0.000-+--trixie, 0.000-+--Trixie, 0.000-+--cves, 0.000-+--CVEs, 0.000-+--uncompress Return-path: <ejas.ali.mohammad@accenture.com> Received: from mail-eastus2azlp170110003.outbound.protection.outlook.com ([2a01:111:f403:c110::3]:48587 helo=BN8PR05CU002.outbound.protection.outlook.com) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP384R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <ejas.ali.mohammad@accenture.com>) id 1wvVNP-009CW8-16 for submit@bugs.debian.org; Sun, 16 Aug 2026 07:33:52 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=S+lRldqUIovf8iuQmrM8TRQrTSSbyR2FZU1KEiJVlL3wLmKFjL4zX8zEaz0WbBgTRF52A/oWQbvX77bGW5GmCFQqYgHdiw8FIvAGadP7KD2w/+dlf6QraSncPJZtqB63r9fKG76g3ZX5eunxkGuWNSk0d/1xFhmrtOYt+fLP4bZZ8w8qIjThOHyoBUwA0Qrn5jZapKgJl79l/5+7FcWiEZU0AIVMDYKjWHlpmsi+eyuFn1XfQT5GK89PNlNSGk7id2AI39ni5rJyFXlJRGruC9VzVTiUE3HxJcVOfh037Ie7XCJ09SbR/efx6H+DHwxr1R75lN88dInmRx+xBhKSIA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=MibXKDAWCXgUFPeoL6GR33VTCyDY5KErOBS3Dnn9i00=; b=kLXTU3/e3pGKV+rKa8QS4NeeYt13nHfSGY9qILpsEpXOQZL3z0Gy3La6kT+3PWq6rv5oNO1gnyLzq/SM63FyhxtleAvHJptC0hQ4u47dCSOhKArtCOAuS+kSKSPC7SjgOZz+x+esKXmzPOwEcVqg9fbng6bYlTzMujYGo1eFC1d4fmpMfmS79pPhM+7wQ8jmqxjhu7iV+rCrG4oZRjgfAiVxKhutPmWhbC3v+qj8Lu/QIq5uZlwqae69JgrIazPXDXtpV4arsaLNrfL8d+nhp/hmxT6WOQs/x3nM6AWhuAzm9dHciQxwN4XIlv/L2JejNAmsl/bRitJVhhDmX4eGag== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=accenture.com; dmarc=pass action=none header.from=accenture.com; dkim=pass header.d=accenture.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=accenture.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=MibXKDAWCXgUFPeoL6GR33VTCyDY5KErOBS3Dnn9i00=; b=Hyvz39tDCkMuYX8vpvDYAFaPN0P5RZU3SEE+Iqgox70kaQpxB6s+t1k9ugeIuRM4hQt6tVbSoQSMfOSzRQ2PR2q2ocKIKbPabL7j4lBTa6GHzAxZMAEa/ETZ1aeJMaGahgsS3YBh3+2sI58ngqODd+0DUxo8Sfm6C2mdWt2+hOs4cJ1+f+rY57G7x6FohPAvX9JP+eptsssP/zN2xhzGfVM+KcvDcZwDhIUqPZc5P9ujszcf7UqzYf7jgE7LiIYljsuzOO1+uC/9mA7y/zjd6aF1WIfBYT8M0fwPJykDHw4H+0jhocPmLU8Ok+PSSTZcX9bwSNOpdeTtOVVZEmYMZg== Received: from PH8P114MB2205.NAMP114.PROD.OUTLOOK.COM (2603:10b6:510:355::7) by DS0P114MB1929.NAMP114.PROD.OUTLOOK.COM (2603:10b6:8:1a5::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.315.17; Sun, 16 Aug 2026 07:33:45 +0000 Received: from PH8P114MB2205.NAMP114.PROD.OUTLOOK.COM ([fe80::37de:af0d:edae:1bc8]) by PH8P114MB2205.NAMP114.PROD.OUTLOOK.COM ([fe80::37de:af0d:edae:1bc8%4]) with mapi id 15.21.0315.016; Sun, 16 Aug 2026 07:33:45 +0000 From: "Mohammad, Ejas Ali" <ejas.ali.mohammad@accenture.com> To: "submit@bugs.debian.org" <submit@bugs.debian.org> Subject: perl: 8 unpatched security CVEs - request fix for trixie Thread-Topic: perl: 8 unpatched security CVEs - request fix for trixie Thread-Index: Ad0tUYiimN/tpXhKRxmyWU4AQk+veg== Date: Sun, 16 Aug 2026 07:33:45 +0000 Message-ID: <PH8P114MB220533421DDA5CAD5C6B0716BED82@PH8P114MB2205.NAMP114.PROD.OUTLOOK.COM> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=accenture.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: PH8P114MB2205:EE_|DS0P114MB1929:EE_ x-ms-office365-filtering-correlation-id: a74cb92b-1e64-4cf9-7365-08defb68b46f x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; ARA:13230040|23010399003|376014|366016|1800799024|18002099003|8096899003|56012099006|3023799007|38070700021|6133799003|10067099003|11063799006; x-microsoft-antispam-message-info: XWeYcZI96yNTk1mk41YQh0/cnfyVCP5Rrf2PHMkc0fnnv0NLKy+Hi+764dOwIVsAgX0brppkS+P9v4EHhaZMovTdtb4PzJQzlb3O5tgtB3I+C393oZNxgR2ehq8r9G1tbA/HDMGbO9ZSy6ZJyoPBLXtK0AFHrcJUXI3l7TlmNYtneNP0l5FgjTmB6AgWBZ4e4SsgvtX2NkLN4OKvoaY29p2BXKIXn5O7ccj6L/GkqjH/DYHRh8kYLaQ0UZjYGp1tKhsygJiw6f8qzmynE2yZ0lydrSFfFnDOw6pQb9GtJKNkQ124P/Bm/IwtNPfbk+guatNSTzOVmq4Z3mWAbVIZxWxTdluv/hdR37EXuD3H3bF1ZrQigfdcN94uNjjHgDNavFcjlUrhxnALJlbJ39OVxVYrqiJajd/m9oDBp7UhCi05wi1vn+H1V7LMOnTnhRck7T6bMk0BRgZtlCmGxMYNIcUGEVMnV4DAdIK7IAY332gHJapJoipNBjPA889tLZk0eyk6v6gpnVliHcFQRoomdrN9C5OVxt4qzU4T0rLdYLB4lGKVGfpu7ryBI1dOy2TjMs5zaY/Huibjn/U3+0eS4KSugjbrkMcVrhWcss+N/R8gVCfzecdfwf1vgYp7gR+AeweJTDQ2KNWzWPY6sFpaBfFVymBGyRCjjLs3HsxgHtokoJXhI+XFdTR/MlyRBJwR9ZiG+mskGHEm+Q+8hwaEv25UpfvizY4AdnaZ8lm8A8w= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:PH8P114MB2205.NAMP114.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(13230040)(23010399003)(376014)(366016)(1800799024)(18002099003)(8096899003)(56012099006)(3023799007)(38070700021)(6133799003)(10067099003)(11063799006); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?CE9PXWBP3cpIw1P/P1PGpj/XL6JNW/Xmcx+muVbrSDHVicD2nVKFQSccOh/u?= =?us-ascii?Q?5uyg5454n6vzaUNpiBABYIXVGX3gllvQ62MvsENfGSGZHo9QsUBSiGpmseN7?= =?us-ascii?Q?4ZpkJYDC95DscpHSI3JUGYFuoUB9XLuYmz9R28S3MRDxh72mkpcGs/ilLTCF?= =?us-ascii?Q?zT3OgWC2UB/ZABrB6cUQEX+xeDjzV6K5YcMKcCmJnU2PpDLgDLooqvpkV8NV?= =?us-ascii?Q?JoNCkc0hjF5G2T66QQt21cnKOsyBPKKhURddlt/bSUugxGmGxE5cCuXOo2GA?= =?us-ascii?Q?n/QeruC0G6sQmz6pAWv0+6YWfuXZCPcU656vAh+B3yhmIUNuEOuXoySTPBrw?= =?us-ascii?Q?XUzN/pwJc7NiphXy4hDqpHAuF5bc7gaCf8vfHeJV7OipefyMpofQ1czPUenn?= =?us-ascii?Q?GBlwMSFLD7Bi+xmwNeCLKRe2geZS7cg9iid3Fxea2mCTPbwtn5tMxjC7l8VM?= =?us-ascii?Q?hMNVBsJiBWEJ4LUcEbgygEBwSs+ivntllbmBBPDh9cu2Kz87/m+AF3a7aclP?= =?us-ascii?Q?HW+9Cpjahlcr9t666YusgwXRzoIeDQXJOYvDBX1yXW5HYQx2Sl2foLmZgB3L?= =?us-ascii?Q?qabWZ06LE2PbqPDjjde6UvX1W0qzAH1qTE7UhQbarLs1L9zUa4hlBHX2j2It?= =?us-ascii?Q?zFEfNMfWFW72d3iJZKu70KwtiTrJoQB5jkFMSHT2J4CmNn4KrprQNYm7uH94?= =?us-ascii?Q?yJ6qNgDrH6MRSSAVUB+u6DOq2XQRLgto1+sfoIN2EI7XZ91fr1klg6jEZHTx?= =?us-ascii?Q?wwlxShcu8HSfHHgqifL6q5avSJPK1Lv8QvFmBGwEuKbXsVTkpeCHoIBAB/xb?= =?us-ascii?Q?EGLv490BPJC+eXahXvofpIifC+AZo7b9slUT1TWGpMjzlJ+9T6wjnx52BoeD?= =?us-ascii?Q?Lh1+0Yx142MxNR4hyeqRCq+8Gh6F2L3DSIi8MjAp7Uc6n3yn+inWCrvvAmZS?= =?us-ascii?Q?4d5JgDG1PYXs0egDd3fLj5BYUfcMSb++IJcdsU6lPF6hru+vmHCGZVyrRnlf?= =?us-ascii?Q?j7hSoghx31o3ZemdEB/f4Do0Mfpj4Z1J2rVSxzl/soA8ueHx+737g+MNg+BN?= =?us-ascii?Q?5ZqP6/LTTQrS1XhA3t1X4egWPZ2rKUrso2DTmg01B8y3Wff7S1bNojllp2Xj?= =?us-ascii?Q?1IILb3iQcw5YX7mnOpmAolJ1MDG/eTIxOlgQl/t4XxFkwL+TaUnxh5d9cGTO?= =?us-ascii?Q?xFhzcnB8dppcgdiD7bV7TJRMXT7gaUcHr6U25GTKsLg9xlwZ8LKIKmmuGFH1?= =?us-ascii?Q?7y8vwVOMrh6P2KZyygSSYtBbie3UzMNtnV8duVtCrUbZVxWe7suHiobaK0zn?= =?us-ascii?Q?BX86mX9OKbz8GZ/CV4eU3oPirZUEinvhxQB+aLxgpkviR0uHGlYb2UlAJ1pk?= =?us-ascii?Q?a69hbb2EyxGv/1P1c8SjXemurizOjikL0DUBE3TlO3jQupcE55f6szcQj7Zs?= =?us-ascii?Q?n+kN+977k2/FmM0PH2I1XqFJRYYcic28y9c56fzDgBDX2+7uHTO2WoATXsO8?= =?us-ascii?Q?YE9bLGswYXVvzAibOXxBuOJgWfTcUFOim2E+xG/6jkr6xyCuGNiCToEl4M2e?= =?us-ascii?Q?ueiOFWCkaWX0v/iXJrqn8DOFpuyU7inr/nNE0pcCr7NXkgmActqE3tLYlz4I?= =?us-ascii?Q?3AAxTYJ2VA8tacU7N/j+OG/a5rGvm08H91UZpE7yGdi+YwwKdexRD33QgAlR?= =?us-ascii?Q?jxZbEzFltiHJI9f8UnqHGQ9I99MH7tCDzozPd0Vm1FHLmDWd4ttgWoGPEDCz?= =?us-ascii?Q?iThft3VCX/80nbABcvCE4JeC9GoaK0g=3D?= Content-Type: multipart/alternative; boundary="_000_PH8P114MB220533421DDA5CAD5C6B0716BED82PH8P114MB2205NAMP_" MIME-Version: 1.0 X-OriginatorOrg: accenture.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: PH8P114MB2205.NAMP114.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: a74cb92b-1e64-4cf9-7365-08defb68b46f X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Aug 2026 07:33:45.5183 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: e0793d39-0939-496d-b129-198edd916feb X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: sJCHOuS0emlqvpvGULLVVxNOlsmeuv6Mpa38vEkUgALxPLx/2awrp4I3rlZsLBh7IJbMufhvQhwTone/RZf1+eY7mX0WQ/RGzk7kco0CzLA= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0P114MB1929 Delivered-To: submit@bugs.debian.org --_000_PH8P114MB220533421DDA5CAD5C6B0716BED82PH8P114MB2205NAMP_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Package: perl Version: 5.40.1-6 Severity: Critical & High Hi Debian Security Team, The following CVEs are reported against the perl source package in Trixie a= nd have no fix available at time of filing. S.No CVE CVSS Component Issue 1 CVE-2026-57433 9.8 Storable Signed integer overflow on SX_HOOK deserialization; crafted thaw() input pa= nics the process 2 CVE-2026-12087 9.1 Socket pack_ip_mreq_source() validates wrong argument length; heap out-of-bounds r= ead up to 3 bytes 3 CVE-2026-13221 9.1 perl core (regex) Alternation > 65535 branches overflows 16-bit trie field; silent false-posi= tive/negative matches 4 CVE-2026-57432 8.4 perl core (pack/un Integer overflow in S_measure_struct; large repeat count leaks heap memory = to caller 5 CVE-2026-48959 7.5 IO::Uncompress fastForward() compares offset digit count instead of offset value; CPU exha= ustion on crafted zip 6 CVE-2026-48962 7.3 IO::Compress File::GlobMapper runs caller-supplied output glob through eval STRING; arbi= trary code execution 7 CVE-2026-48961 7.3 IO::Compress zipdetails crashes on Info-ZIP Unix Extra Field with 8-byte UID/GID; undefi= ned subroutine 8 CVE-2026-7017 7.1 HTTP::Tiny Authorization/Cookie headers forwarded to cross-origin redirect targets wit= hout origin check All eight CVEs show Fix Status: open on the Debian security tracker. Please= provide patched packages for trixie. Regards, Ejas Ali ________________________________ This message is for the designated recipient only and may contain privilege= d, proprietary, or otherwise confidential information. If you have received= it in error, please notify the sender immediately and delete the original.= Any other use of the e-mail by you is prohibited. Where allowed by local l= aw, electronic communications with Accenture and its affiliates, including = e-mail and instant messaging (including content), may be scanned by our sys= tems for the purposes of information security, AI-powered support capabilit= ies, and assessment of internal compliance with Accenture policy. Your priv= acy is important to us. Accenture uses your personal data only in complianc= e with data protection laws. For further information on how Accenture proce= sses your personal data, please see our privacy statement at https://www.ac= centure.com/us-en/privacy-policy. ___________________________________________________________________________= ___________ www.accenture.com --_000_PH8P114MB220533421DDA5CAD5C6B0716BED82PH8P114MB2205NAMP_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr= osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:x=3D"urn:schemas-microsoft-com:office:excel" xmlns:m=3D"http://schema= s.microsoft.com/office/2004/12/omml" xmlns=3D"http://www.w3.org/TR/REC-html= 40"> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"= > <meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)"> <style><!-- /* Font Definitions */ @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Aptos;} @font-face {font-family:"Aptos Narrow";} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; font-size:12.0pt; font-family:"Aptos",sans-serif; mso-ligatures:standardcontextual;} span.EmailStyle17 {mso-style-type:personal-compose; font-family:"Aptos",sans-serif; color:windowtext;} .MsoChpDefault {mso-style-type:export-only;} @page WordSection1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;} div.WordSection1 {page:WordSection1;} --></style><!--[if gte mso 9]><xml> <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext=3D"edit"> <o:idmap v:ext=3D"edit" data=3D"1" /> </o:shapelayout></xml><![endif]--> </head> <body lang=3D"EN-US" link=3D"#467886" vlink=3D"#96607D" style=3D"word-wrap:= break-word"> <div class=3D"WordSection1"> <p class=3D"MsoNormal"><b><span style=3D"font-size:11.0pt">Package</span></= b><span style=3D"font-size:11.0pt">: perl<o:p></o:p></span></p> <p class=3D"MsoNormal"><b><span style=3D"font-size:11.0pt">Version</span></= b><span style=3D"font-size:11.0pt">: 5.40.1-6<o:p></o:p></span></p> <p class=3D"MsoNormal"><b><span style=3D"font-size:11.0pt">Severity</span><= /b><span style=3D"font-size:11.0pt">: Critical & High<o:p></o:p></span>= </p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt"><o:p> </o:p></= span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt">Hi Debian Security = Team,<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt"><o:p> </o:p></= span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt">The following CVEs = are reported against the perl source package in Trixie and have no fix avai= lable at time of filing.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt"><o:p> </o:p></= span></p> <table class=3D"MsoNormalTable" border=3D"0" cellspacing=3D"0" cellpadding= =3D"0" width=3D"935" style=3D"width:701.0pt;border-collapse:collapse"> <tbody> <tr style=3D"height:14.5pt"> <td width=3D"64" nowrap=3D"" valign=3D"bottom" style=3D"width:48.0pt;border= :solid windowtext 1.0pt;background:#BFBFBF;padding:0in 5.4pt 0in 5.4pt;heig= ht:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">S.No<o:p></o:p>= </span></p> </td> <td width=3D"134" nowrap=3D"" valign=3D"bottom" style=3D"width:100.25pt;bor= der:solid windowtext 1.0pt;border-left:none;background:#BFBFBF;padding:0in = 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">CVE<o:p></o:p><= /span></p> </td> <td width=3D"37" nowrap=3D"" valign=3D"bottom" style=3D"width:27.75pt;borde= r:solid windowtext 1.0pt;border-left:none;background:#BFBFBF;padding:0in 5.= 4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">CVSS<o:p></o:p>= </span></p> </td> <td width=3D"115" nowrap=3D"" valign=3D"bottom" style=3D"width:86.0pt;borde= r:solid windowtext 1.0pt;border-left:none;background:#BFBFBF;padding:0in 5.= 4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">Component<o:p><= /o:p></span></p> </td> <td width=3D"585" nowrap=3D"" valign=3D"bottom" style=3D"width:439.0pt;bord= er:solid windowtext 1.0pt;border-left:none;background:#BFBFBF;padding:0in 5= .4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">Issue <o:p></o:p></span></p> </td> </tr> <tr style=3D"height:14.5pt"> <td width=3D"64" nowrap=3D"" valign=3D"bottom" style=3D"width:48.0pt;border= :solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt;height:= 14.5pt"> <p class=3D"MsoNormal" align=3D"right" style=3D"text-align:right"><span sty= le=3D"font-size:11.0pt;font-family:"Aptos Narrow",sans-serif;colo= r:black;mso-ligatures:none">1<o:p></o:p></span></p> </td> <td width=3D"134" nowrap=3D"" valign=3D"bottom" style=3D"width:100.25pt;bor= der-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-r= ight:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">CVE-2026-57433<= o:p></o:p></span></p> </td> <td width=3D"37" nowrap=3D"" valign=3D"bottom" style=3D"width:27.75pt;borde= r-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-rig= ht:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal" align=3D"right" style=3D"text-align:right"><span sty= le=3D"font-size:11.0pt;font-family:"Aptos Narrow",sans-serif;colo= r:black;mso-ligatures:none">9.8<o:p></o:p></span></p> </td> <td width=3D"115" nowrap=3D"" valign=3D"bottom" style=3D"width:86.0pt;borde= r-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-rig= ht:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">Storable<o:p></= o:p></span></p> </td> <td width=3D"585" nowrap=3D"" valign=3D"bottom" style=3D"width:439.0pt;bord= er-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-ri= ght:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">Signed integer = overflow on SX_HOOK deserialization; crafted thaw() input panics the proces= s<o:p></o:p></span></p> </td> </tr> <tr style=3D"height:14.5pt"> <td width=3D"64" nowrap=3D"" valign=3D"bottom" style=3D"width:48.0pt;border= :solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt;height:= 14.5pt"> <p class=3D"MsoNormal" align=3D"right" style=3D"text-align:right"><span sty= le=3D"font-size:11.0pt;font-family:"Aptos Narrow",sans-serif;colo= r:black;mso-ligatures:none">2<o:p></o:p></span></p> </td> <td width=3D"134" nowrap=3D"" valign=3D"bottom" style=3D"width:100.25pt;bor= der-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-r= ight:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">CVE-2026-12087<= o:p></o:p></span></p> </td> <td width=3D"37" nowrap=3D"" valign=3D"bottom" style=3D"width:27.75pt;borde= r-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-rig= ht:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal" align=3D"right" style=3D"text-align:right"><span sty= le=3D"font-size:11.0pt;font-family:"Aptos Narrow",sans-serif;colo= r:black;mso-ligatures:none">9.1<o:p></o:p></span></p> </td> <td width=3D"115" nowrap=3D"" valign=3D"bottom" style=3D"width:86.0pt;borde= r-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-rig= ht:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">Socket<o:p></o:= p></span></p> </td> <td width=3D"585" nowrap=3D"" valign=3D"bottom" style=3D"width:439.0pt;bord= er-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-ri= ght:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">pack_ip_mreq_so= urce() validates wrong argument length; heap out-of-bounds read up to 3 byt= es<o:p></o:p></span></p> </td> </tr> <tr style=3D"height:14.5pt"> <td width=3D"64" nowrap=3D"" valign=3D"bottom" style=3D"width:48.0pt;border= :solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt;height:= 14.5pt"> <p class=3D"MsoNormal" align=3D"right" style=3D"text-align:right"><span sty= le=3D"font-size:11.0pt;font-family:"Aptos Narrow",sans-serif;colo= r:black;mso-ligatures:none">3<o:p></o:p></span></p> </td> <td width=3D"134" nowrap=3D"" valign=3D"bottom" style=3D"width:100.25pt;bor= der-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-r= ight:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">CVE-2026-13221<= o:p></o:p></span></p> </td> <td width=3D"37" nowrap=3D"" valign=3D"bottom" style=3D"width:27.75pt;borde= r-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-rig= ht:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal" align=3D"right" style=3D"text-align:right"><span sty= le=3D"font-size:11.0pt;font-family:"Aptos Narrow",sans-serif;colo= r:black;mso-ligatures:none">9.1<o:p></o:p></span></p> </td> <td width=3D"115" nowrap=3D"" valign=3D"bottom" style=3D"width:86.0pt;borde= r-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-rig= ht:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">perl core (rege= x)<o:p></o:p></span></p> </td> <td width=3D"585" nowrap=3D"" valign=3D"bottom" style=3D"width:439.0pt;bord= er-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-ri= ght:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">Alternation &gt= ; 65535 branches overflows 16-bit trie field; silent false-positive/negativ= e matches<o:p></o:p></span></p> </td> </tr> <tr style=3D"height:14.5pt"> <td width=3D"64" nowrap=3D"" valign=3D"bottom" style=3D"width:48.0pt;border= :solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt;height:= 14.5pt"> <p class=3D"MsoNormal" align=3D"right" style=3D"text-align:right"><span sty= le=3D"font-size:11.0pt;font-family:"Aptos Narrow",sans-serif;colo= r:black;mso-ligatures:none">4<o:p></o:p></span></p> </td> <td width=3D"134" nowrap=3D"" valign=3D"bottom" style=3D"width:100.25pt;bor= der-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-r= ight:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">CVE-2026-57432<= o:p></o:p></span></p> </td> <td width=3D"37" nowrap=3D"" valign=3D"bottom" style=3D"width:27.75pt;borde= r-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-rig= ht:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal" align=3D"right" style=3D"text-align:right"><span sty= le=3D"font-size:11.0pt;font-family:"Aptos Narrow",sans-serif;colo= r:black;mso-ligatures:none">8.4<o:p></o:p></span></p> </td> <td width=3D"115" nowrap=3D"" valign=3D"bottom" style=3D"width:86.0pt;borde= r-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-rig= ht:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">perl core (pack= /un<o:p></o:p></span></p> </td> <td width=3D"585" nowrap=3D"" valign=3D"bottom" style=3D"width:439.0pt;bord= er-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-ri= ght:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">Integer overflo= w in S_measure_struct; large repeat count leaks heap memory to caller<o:p><= /o:p></span></p> </td> </tr> <tr style=3D"height:14.5pt"> <td width=3D"64" nowrap=3D"" valign=3D"bottom" style=3D"width:48.0pt;border= :solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt;height:= 14.5pt"> <p class=3D"MsoNormal" align=3D"right" style=3D"text-align:right"><span sty= le=3D"font-size:11.0pt;font-family:"Aptos Narrow",sans-serif;colo= r:black;mso-ligatures:none">5<o:p></o:p></span></p> </td> <td width=3D"134" nowrap=3D"" valign=3D"bottom" style=3D"width:100.25pt;bor= der-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-r= ight:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">CVE-2026-48959<= o:p></o:p></span></p> </td> <td width=3D"37" nowrap=3D"" valign=3D"bottom" style=3D"width:27.75pt;borde= r-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-rig= ht:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal" align=3D"right" style=3D"text-align:right"><span sty= le=3D"font-size:11.0pt;font-family:"Aptos Narrow",sans-serif;colo= r:black;mso-ligatures:none">7.5<o:p></o:p></span></p> </td> <td width=3D"115" nowrap=3D"" valign=3D"bottom" style=3D"width:86.0pt;borde= r-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-rig= ht:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">IO::Uncompress<= o:p></o:p></span></p> </td> <td width=3D"585" nowrap=3D"" valign=3D"bottom" style=3D"width:439.0pt;bord= er-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-ri= ght:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">fastForward() c= ompares offset digit count instead of offset value; CPU exhaustion on craft= ed zip<o:p></o:p></span></p> </td> </tr> <tr style=3D"height:14.5pt"> <td width=3D"64" nowrap=3D"" valign=3D"bottom" style=3D"width:48.0pt;border= :solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt;height:= 14.5pt"> <p class=3D"MsoNormal" align=3D"right" style=3D"text-align:right"><span sty= le=3D"font-size:11.0pt;font-family:"Aptos Narrow",sans-serif;colo= r:black;mso-ligatures:none">6<o:p></o:p></span></p> </td> <td width=3D"134" nowrap=3D"" valign=3D"bottom" style=3D"width:100.25pt;bor= der-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-r= ight:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">CVE-2026-48962<= o:p></o:p></span></p> </td> <td width=3D"37" nowrap=3D"" valign=3D"bottom" style=3D"width:27.75pt;borde= r-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-rig= ht:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal" align=3D"right" style=3D"text-align:right"><span sty= le=3D"font-size:11.0pt;font-family:"Aptos Narrow",sans-serif;colo= r:black;mso-ligatures:none">7.3<o:p></o:p></span></p> </td> <td width=3D"115" nowrap=3D"" valign=3D"bottom" style=3D"width:86.0pt;borde= r-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-rig= ht:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">IO::Compress<o:= p></o:p></span></p> </td> <td width=3D"585" nowrap=3D"" valign=3D"bottom" style=3D"width:439.0pt;bord= er-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-ri= ght:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">File::GlobMappe= r runs caller-supplied output glob through eval STRING; arbitrary code exec= ution<o:p></o:p></span></p> </td> </tr> <tr style=3D"height:14.5pt"> <td width=3D"64" nowrap=3D"" valign=3D"bottom" style=3D"width:48.0pt;border= :solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt;height:= 14.5pt"> <p class=3D"MsoNormal" align=3D"right" style=3D"text-align:right"><span sty= le=3D"font-size:11.0pt;font-family:"Aptos Narrow",sans-serif;colo= r:black;mso-ligatures:none">7<o:p></o:p></span></p> </td> <td width=3D"134" nowrap=3D"" valign=3D"bottom" style=3D"width:100.25pt;bor= der-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-r= ight:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">CVE-2026-48961<= o:p></o:p></span></p> </td> <td width=3D"37" nowrap=3D"" valign=3D"bottom" style=3D"width:27.75pt;borde= r-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-rig= ht:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal" align=3D"right" style=3D"text-align:right"><span sty= le=3D"font-size:11.0pt;font-family:"Aptos Narrow",sans-serif;colo= r:black;mso-ligatures:none">7.3<o:p></o:p></span></p> </td> <td width=3D"115" nowrap=3D"" valign=3D"bottom" style=3D"width:86.0pt;borde= r-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-rig= ht:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">IO::Compress<o:= p></o:p></span></p> </td> <td width=3D"585" nowrap=3D"" valign=3D"bottom" style=3D"width:439.0pt;bord= er-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-ri= ght:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">zipdetails cras= hes on Info-ZIP Unix Extra Field with 8-byte UID/GID; undefined subroutine<= o:p></o:p></span></p> </td> </tr> <tr style=3D"height:14.5pt"> <td width=3D"64" nowrap=3D"" valign=3D"bottom" style=3D"width:48.0pt;border= :solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt;height:= 14.5pt"> <p class=3D"MsoNormal" align=3D"right" style=3D"text-align:right"><span sty= le=3D"font-size:11.0pt;font-family:"Aptos Narrow",sans-serif;colo= r:black;mso-ligatures:none">8<o:p></o:p></span></p> </td> <td width=3D"134" nowrap=3D"" valign=3D"bottom" style=3D"width:100.25pt;bor= der-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-r= ight:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">CVE-2026-7017<o= :p></o:p></span></p> </td> <td width=3D"37" nowrap=3D"" valign=3D"bottom" style=3D"width:27.75pt;borde= r-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-rig= ht:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal" align=3D"right" style=3D"text-align:right"><span sty= le=3D"font-size:11.0pt;font-family:"Aptos Narrow",sans-serif;colo= r:black;mso-ligatures:none">7.1<o:p></o:p></span></p> </td> <td width=3D"115" nowrap=3D"" valign=3D"bottom" style=3D"width:86.0pt;borde= r-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-rig= ht:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">HTTP::Tiny<o:p>= </o:p></span></p> </td> <td width=3D"585" nowrap=3D"" valign=3D"bottom" style=3D"width:439.0pt;bord= er-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-ri= ght:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:14.5pt"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ap= tos Narrow",sans-serif;color:black;mso-ligatures:none">Authorization/C= ookie headers forwarded to cross-origin redirect targets without origin che= ck<o:p></o:p></span></p> </td> </tr> </tbody> </table> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt"><o:p> </o:p></= span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt">All eight CVEs show= Fix Status: open on the Debian security tracker. Please provide patched pa= ckages for trixie.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt"><o:p> </o:p></= span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt">Regards,<o:p></o:p>= </span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt">Ejas Ali<o:p></o:p>= </span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt"><o:p> </o:p></= span></p> </div> <br> <hr> <font face=3D"Arial" color=3D"Gray" size=3D"1"><br> This message is for the designated recipient only and may contain privilege= d, proprietary, or otherwise confidential information. If you have received= it in error, please notify the sender immediately and delete the original.= Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications w= ith Accenture and its affiliates, including e-mail and instant messaging (i= ncluding content), may be scanned by our systems for the purposes of inform= ation security, AI-powered support capabilities, and assessment of internal compliance with Accenture policy.= Your privacy is important to us. Accenture uses your personal data only in= compliance with data protection laws. For further information on how Accen= ture processes your personal data, please see our privacy statement at https://www.accenture.com/us-en/privac= y-policy. <br> ___________________________________________________________________________= ___________<br> <br> www.accenture.com<br> </font> </body> </html> --_000_PH8P114MB220533421DDA5CAD5C6B0716BED82PH8P114MB2205NAMP_-- ]