Bug#1150541: libextutils-typemaps-default-perl: CVE-2026-107373 CVE-2026-107794

[Salvatore Bonaccorso]

Source: libextutils-typemaps-default-perl
Version: 1.05-5
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security upstream

Hi,

The following vulnerabilities were published for libextutils-typemaps-default-perl.

CVE-2026-107373[0]:
| ExtUtils::Typemaps::STL::String versions before 1.06 for Perl
| T_STD_STRING typemap may read the SV length before stringifying the
| argument.  The typemap uses      $var = std::string(
| SvPV_nolen($arg), SvCUR($arg) )  However, evaluation order for C++
| arguments is not specified, and some compilers may produce code that
| evalutes SvCUR($arg) first.  When $arg is not a string (for example,
| an interger, number or a reference) then SvCUR will return an
| invalid value, and the program may abort or segfault.


CVE-2026-107794[1]:
| ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate
| a 32 GiB array on an empty list.  The OUTPUT typemaps call
| av_extend( av, len-1 ). On an empty list, this undeflows, and
| av_extend will allocate an array with 2^32 slots, leading to memory
| exhaustion.  Note that a similar issue was fixed in
| ExtUtils::Typemaps::STL::Vector version 1.05.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-107373
    https://www.cve.org/CVERecord?id=CVE-2026-107373
    https://lists.security.metacpan.org/cve-announce/msg/44245994/
[1] https://security-tracker.debian.org/tracker/CVE-2026-107794
    https://www.cve.org/CVERecord?id=CVE-2026-107794
    https://lists.security.metacpan.org/cve-announce/msg/44246012/

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore