[From nobody Mon Aug 17 22:21:11 2026 Received: (at 1140152-close) by bugs.debian.org; 17 Aug 2026 21:19:15 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.1 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA, FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE, SPF_HELO_PASS,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 48; hammy, 150; neutral, 198; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from mailly.debian.org ([2001:41b8:202:deb:6564:a62:52c3:4b72]:43094) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1ww4jj-00E9hM-2N for 1140152-close@bugs.debian.org; Mon, 17 Aug 2026 21:19:15 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mailly.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1ww4ji-00BOLJ-0o for 1140152-close@bugs.debian.org; Mon, 17 Aug 2026 21:19:14 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=GDUoWgX8z5N9/6LjV1a4jsPOsvQTP9z+IwC5WFoZtz8=; b=eu16NQK5XcV4Rxtf4WMh6vd48d ZqwHzy7z1uenbSzFfGPIxyh5H4hmY2mjQtsEdkoCY+bx6oN0tsHFkMACffCwi2qPaYEnBGktX4e6r xc1MTXkjNRw7ereK/VcUIwPp3WCFRQUzBoRpTHKxsYi+hez6Xd9Cr52eLZRTjxWFlQ3Q1SM2G8nmt AMMJ4+fQmBMRWkkOx2mBnPHtlshRyDT1kPVLycRlT96SjsApkc3wHl5ahpF0o37tBL3za+vrLh5d8 fbc323f41NCHz88JIgAFwGD8VC4Y6+yENgHzsIQiKcJLB0Yn5L2ThmRcyqggvXNKz8P6ny4dF1dCC aIP3dpKQ==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1ww4jh-0000000GnT4-1P5d; Mon, 17 Aug 2026 21:19:13 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Niko Tyni <ntyni@debian.org> To: 1140152-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: perl Debian: DAK Debian-Changes: perl_5.42.3-1_source.changes Debian-Source: perl Debian-Version: 5.42.3-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1140152: fixed in perl 5.42.3-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============3314920638300717470==" Message-Id: <E1ww4jh-0000000GnT4-1P5d@fasolo.debian.org> Date: Mon, 17 Aug 2026 21:19:13 +0000 --===============3314920638300717470== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: perl Source-Version: 5.42.3-1 Done: Niko Tyni <ntyni@debian.org> We believe that the bug you reported is fixed in the latest version of perl, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1140152@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Niko Tyni <ntyni@debian.org> (supplier of updated perl package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA384 Format: 1.8 Date: Mon, 17 Aug 2026 22:59:18 +0300 Source: perl Architecture: source Version: 5.42.3-1 Distribution: unstable Urgency: medium Maintainer: Niko Tyni <ntyni@debian.org> Changed-By: Niko Tyni <ntyni@debian.org> Closes: 1138859 1138860 1138861 1140152 1141639 1142037 Changes: perl (5.42.3-1) unstable; urgency=3Dmedium . * Update to new upstream version 5.42.3. * [SECURITY] includes various upstream fixes: + CVE-2026-7017: HTTP::Tiny credential forwarding on redirects. (Closes: #1141639) + CVE-2026-9538: Archive::Tar memory exhaustion. (Closes: #1138861) + CVE-2026-42496: Archive::Tar symlink extraction. (Closes: #1138860) + CVE-2026-42497: Archive::Tar hardlink extraction. (Closes: #1138859) + CVE-2026-12087: Socket: pack_ip_mreq_source() out-of-bounds heap read. (Closes: #1140152) + CVE-2026-13221: silently incorrect regular expression matches. (Closes: #1142037) * Refresh cross support files for all architectures. + also update the architecture lists in d/cross/README * Disable salsa-ci.yml as nobody currently cares about the results. * Update debian/copyright based on DFSG team review. Checksums-Sha1: a312494e84f08a1bd4a29edeae6dd7af59e06b1c 2372 perl_5.42.3-1.dsc 1dcede801d09bd47ad351fb4d6280edd879772ed 421372 perl_5.42.3.orig-regen-confi= gure.tar.xz 1d878802a55eacc778bb1d84b1f1b8ab9b22cc96 14495300 perl_5.42.3.orig.tar.xz 5d3bc13b5f9b7b0a8093a466e26f37003c922a34 168064 perl_5.42.3-1.debian.tar.xz c533e6406fe5a3ab42f5a5814a4f5bbe61fc0435 5338 perl_5.42.3-1_source.buildinfo Checksums-Sha256: 36535968b24b1f73ce1cf980208017dbe4a38bff5b501cd752e82139206282f7 2372 perl_5= .42.3-1.dsc 5ae2aea5bc800c05324e4c9b166391b17368d10300c036fbe45f8c23a799c355 421372 perl= _5.42.3.orig-regen-configure.tar.xz c9387e1473a1866935cb047ece7c2e0a80767a3acdecb79d4a375f8a95970ddc 14495300 pe= rl_5.42.3.orig.tar.xz 0b5692654b3efe8be7e469be851ac8abf6a425bba7c2be5a29a0d553a450956f 168064 perl= _5.42.3-1.debian.tar.xz 71408f9f725faa3539ed2d98c1b0f269a4f4d8064daebd44cb891fa0aff2cee4 5338 perl_5= .42.3-1_source.buildinfo Files: 20b760b76e6048cab15d794225bbb2fb 2372 perl standard perl_5.42.3-1.dsc 78cfa5d6df88d464bb118092b5722419 421372 perl standard perl_5.42.3.orig-regen= -configure.tar.xz fb96e6cf064bf374e84ef232b0eda5c1 14495300 perl standard perl_5.42.3.orig.tar= .xz c03a130c2f86e55c9eb492a835f0a4cf 168064 perl standard perl_5.42.3-1.debian.t= ar.xz 1ac4284e689b699f60caca7504d2e3e7 5338 perl standard perl_5.42.3-1_source.bui= ldinfo -----BEGIN PGP SIGNATURE----- iKcEARMJAC8WIQTuZv2Xfg2x/uVxefeK/rNkDrE5sgUCaoNvcxEcbnR5bmlAZGVi aWFuLm9yZwAKCRCK/rNkDrE5srEgAX0RXoXPd0TqEsji+TWA40DTRHIvi9ctyYY/ QA5rNIMgACSGInRTA9LfgfGxHVz828IBgK4HCkE8j9XTfT5LwEGP2a0kwmoCEULu U9DCNBdol5tJx8F0xbiRPCADcrM7ZZAxhg=3D=3D =3DGdB3 -----END PGP SIGNATURE----- --===============3314920638300717470== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCaoN60QAKCRCb9qggYcy5 IZJNAP47M2VqwuhdpTaIRKW74nIlvce7wwJAiV6Pjxu7l9NZzQEAn+co1BbzdyGq po8LzhqrFd9KVfVnDUAMXt9JmhAoDQ4= =8elx -----END PGP SIGNATURE----- --===============3314920638300717470==-- ]