[Git][security-tracker-team/security-tracker][master] Add three new perl issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
05b0b2d2 by Salvatore Bonaccorso at 2026-05-26T05:55:29+02:00
Add three new perl issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,3 +1,12 @@
+CVE-2026-9538 [Perl allow memory exhaustion via attacker controlled entry size field in tar header]
+	- perl <unfixed>
+	NOTE: https://lists.security.metacpan.org/cve-announce/msg/40396448/
+CVE-2026-42497 [Perl extract hardlinks to attacker controlled paths outside the extraction directory]
+	- perl <unfixed>
+	NOTE: https://lists.security.metacpan.org/cve-announce/msg/40396457/
+CVE-2026-42496 [Perl extract symlinks with attacker controlled targets outside the extraction directory]
+	- perl <unfixed>
+	NOTE: https://lists.security.metacpan.org/cve-announce/msg/40396459/
 CVE-2026-48589
 	- shiro <not-affected> (Jakarta EE integration introduced in 2.0.0)
 	NOTE: https://www.openwall.com/lists/oss-security/2026/05/25/9



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/05b0b2d2617e6f714f4b08e9a442694d1a1f4793

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/05b0b2d2617e6f714f4b08e9a442694d1a1f4793
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260526/6a550b70/attachment.htm>