Accepted perl 5.36.0-7+deb12u4 (source) into oldstable-security

[Debian FTP Masters]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 29 Sep 2026 08:59:07 +0700
Source: perl
Architecture: source
Version: 5.36.0-7+deb12u4
Distribution: bookworm-security
Urgency: high
Maintainer: Niko Tyni <ntyni at debian.org>
Changed-By: Arnaud Rebillout <arnaudr at debian.org>
Closes: 1137345 1138854 1138856 1138858 1138859 1138860 1138863 1138905 1138906 1140152 1141639 1142037 1144668
Changes:
 perl (5.36.0-7+deb12u4) bookworm-security; urgency=high
 .
   * Non-maintainer upload by the LTS Team.
   * [SECURITY] various upstream fixes:
     + CVE-2026-7017: HTTP::Tiny credential forwarding on redirects.
         (Closes: #1141639)
     + CVE-2026-42496: Archive::Tar symlink extraction.
         (Closes: #1138860)
     + CVE-2026-42497: Archive::Tar hardlink extraction.
         (Closes: #1138859)
     + CVE-2026-12087: Socket: pack_ip_mreq_source() out-of-bounds heap read.
         (Closes: #1140152)
     + CVE-2026-13221: silently incorrect regular expression matches.
         (Closes: #1142037)
     + CVE-2025-15649: header parsing in IO::Uncompress::Unzip.
         (Closes: #1138863)
     + CVE-2026-7010:  CRLF-validation in HTTP::Tiny.
         (Closes: #1138858)
     + CVE-2026-8376:  Buffer overflow in Perl_study_chunk.
         (Closes: #1137345)
     + CVE-2026-48959: CPU exhaustion in IO::Uncompress::Unzip.
         (Closes: #1138856)
     + CVE-2026-48962: code execution in IO-Compress via output globs.
         (Closes: #1138854)
     + CVE-2026-57432: out of bound heap reads in pack() and unpack().
          (Closes: #1138905)
     + CVE-2026-57433: signed integer overflow in Storable.
          (Closes: #1138906)
     + CVE-2026-19487: incorrect regular expression match results
          (Closes: #1144668)
Checksums-Sha1:
 deee455a754c1dff25218c26f68898317f4842e3 2922 perl_5.36.0-7+deb12u4.dsc
 482ccf337df6318fad5c2621afbe6794d58a0ec5 417784 perl_5.36.0.orig-regen-configure.tar.xz
 938c56a77ae094eb7f5019318a5e4efb2d9c74fa 13051500 perl_5.36.0.orig.tar.xz
 6fac7e37c9a661d5b3c2ca8f9bfbe64bd7d70398 190620 perl_5.36.0-7+deb12u4.debian.tar.xz
 655187ed5a115e2efe5d1d2719d54fdc42501c58 6114 perl_5.36.0-7+deb12u4_source.buildinfo
Checksums-Sha256:
 6f71e571ae69894ad2115013bbc3207e77dc796581e30a62be0297e7d90ee7b9 2922 perl_5.36.0-7+deb12u4.dsc
 10ac353bc5a933403afe60ed1817e7a456f99bdbcaf80c1cdb0eb3a08ea56d4e 417784 perl_5.36.0.orig-regen-configure.tar.xz
 0f386dccbee8e26286404b2cca144e1005be65477979beb9b1ba272d4819bcf0 13051500 perl_5.36.0.orig.tar.xz
 f49d224fa9a6a356e1140f95fb5c864864b5423c9aece94cc68b4d348a3694b6 190620 perl_5.36.0-7+deb12u4.debian.tar.xz
 d6df828c3b33a059e5cb77f47e3caefc6c70515beb2db00d94c742b12672bc7e 6114 perl_5.36.0-7+deb12u4_source.buildinfo
Files:
 a4f32f02c701a76bb592be386429f194 2922 perl standard perl_5.36.0-7+deb12u4.dsc
 4cb6eb41483cc04369cf93367ea6e019 417784 perl standard perl_5.36.0.orig-regen-configure.tar.xz
 826e42da130011699172fd655e49cfa2 13051500 perl standard perl_5.36.0.orig.tar.xz
 dac842767d3856f0298e1775ffd8c226 190620 perl standard perl_5.36.0-7+deb12u4.debian.tar.xz
 cd18e094aef1bfcba4870339a1b155c5 6114 perl standard perl_5.36.0-7+deb12u4_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJHBAEBCgAxFiEE0Kl7ndbut+9n4bYs5yXoeRRgAhYFAmrDVvsTHGFybmF1ZHJA
ZGViaWFuLm9yZwAKCRDnJeh5FGACFr2jD/9StqLWLGh9IBSkBGiysbqyOMcA06hy
oKwY4q4CZvzpBCas2jhUxii5CsXaOIkJ1acVxi1hcyqvCxKczj0HrTTWDVaubwSU
B38igDHxj+bNDLk8VhghdOH/Jn2gLXT7GoN7xzMYl3jrLIIadLxKRqJKtXqQhJuQ
+ZsWTYH/ONA7/oIUbA6YLiXTxyJ49ai+llXWUrikAFlixh5RqGjZHUxXXc6qXM/U
lRjXIHTB62EnZJn+6ab6Wf+2GMYkBqwix0JjijfvxIGbvRtOn9nAgxu51XWYb0Th
F2tcQkJfBVjH9yQ19XgxekAOv5CRsybLmnpFdJVLpEkEwRlnJBv2j5TmEByDcPdl
ndagPmQi3byyfqWNF8zwuOVbthjvqrOOr+DO0nxfhzi7qF7UPqpcCZ/fcItmYfao
cQ1vl6F7Xgx9/NaLwSnIqkGDRL4HKW69Hhzpm7bghQpZagNwg31ZYJ2IcesQU5d+
VcHGGHEci2LHK23013CmwwajgFWrVcsuukk7BuYmbv9TB0AUrQbrhBK9RgfwQZDa
Rcomz7oDemQNH2v1pNmudRkkbMaUB6eL5ZATXrNO+GdC0ScoMAj7J4qxlFuckLEY
NMg5e6R7rYsN1iqIGSrNYdO2JZA6IJpmqoAYGabKb2xmWmc5JDDCqBVPbnQQ5bY7
j6098bIyqr4SOQ==
=Qbnb
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/perl-maintainers/attachments/20261005/8709d09b/attachment.sig>