Fedora Legacy Test Update Notification: perl

Tue Jan 10 01:29:47 UTC 2006

---------------------------------------------------------------------
Fedora Legacy Test Update Notification
FEDORALEGACY-2005-152845
Bugzilla https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=152845
2006-01-09
---------------------------------------------------------------------

Name        : perl
Versions    : rh7.3: perl-5.6.1-38.0.7.3.3.legacy
Versions    : rh9:   perl-5.8.0-90.0.12.legacy
Versions    : fc1:   perl-5.8.3-17.4.legacy
Versions    : fc2:   perl-5.8.3-19.3.legacy
Summary     : The Perl programming language.
Description :
Perl is a high-level programming language commonly used for system
administration utilities and Web programming.

---------------------------------------------------------------------
Update Information:

Updated perl packages that fix several security flaws are now available.

Perl is a high-level programming language commonly used for system
administration utilities and Web programming.

An unsafe file permission bug was discovered in the rmtree() function in
the File::Path module.  The rmtree() function removes files and
directories in an insecure manner, which could allow a local user to
read or delete arbitrary files.  The Common Vulnerabilities and
Exposures project has assigned the name CVE-2004-0452 to this issue.

Solar Designer discovered several temporary file bugs in various Perl
modules.  A local attacker could overwrite or create files as the user
running a Perl script that uses a vulnerable module.  The Common Vulner-
abilities and Exposures project has assigned the name CVE-2004-0976 to
this issue.

Kevin Finisterre discovered a stack based buffer overflow flaw in sperl,
the Perl setuid wrapper. A local user could create a sperl executable
script with a carefully created path name, overflowing the buffer and
leading to root privilege escalation.  The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2005-0156 to
this issue.

Kevin Finisterre discovered a flaw in sperl which can cause debugging
information to be logged to arbitrary files.  By setting an environment
variable, a local user could cause sperl to create, as root, files with
arbitrary filenames, or append the debugging information to existing
files.  The Common Vulnerabilities and Exposures project has assigned
the name CVE-2005-0155 to this issue.

Paul Szabo discovered a bug in the way Perl's File::Path::rmtree module
removed directory trees.  If a local user has write permissions to a
subdirectory within the tree being removed by File::Path::rmtree, it is
possible for them to create setuid binary files.  The Common Vulner-
abilities and Exposures project has assigned the name CVE-2005-0448 to
this issue.  (This issue updates CVE-2004-0452).

Note that CAN-2005-0077 is referred to in the changelogs below.  This
vulnerability does not affect these packages, but is a vulnerability
in perl-DBI packages instead.

Users of perl are advised to upgrade to these packages which contain
backported patches and are not vulnerable to these issues.

---------------------------------------------------------------------
Changelogs

rh7.3:
* Tue Dec 20 2005 David Eisenstein <deisenst at gtw.net>
1:5.6.1-38.0.7.3.3.legacy
- Add BuildRequires: byacc per John Dalbec.  Bug #152835.

* Sat Dec 17 2005 David Eisenstein <deisenst at gtw.net>
1:5.6.1-38.0.7.3.2.legacy
- Add BuildRequires: db2-devel
- Since this is being build in mach, we cannot use the "trick" that Red Hat
  used (of running rpm -q in the build process) to generate the list of
files
  from which *.ph files are pulled.  So instead, I've created two static
files
  which list the same thing, Source11 and Source12.  These two files may
need
  to be refreshed when rebuilding again.

* Fri Dec 16 2005 David Eisenstein <deisenst at gtw.net>
1:5.6.1-38.0.7.3.1.legacy
- fix perldb5.pl (debugger) to use "$ENV{HOME}/.perldbtty$$" instead of
  "/var/run/perldbtty$$", per Bug #152845 comment 33.  Replaces
  perl-5.6.1-solartmp.patch with an updated patch.

* Thu Jul 14 2005 John Dalbec <jpdalbec at ysu.edu> 1:5.6.1-38.0.7.3.legacy
- integrate fix for CAN-2005-0448

* Thu Dec 9 2004 John Dalbec <jpdalbec at ysu.edu> 1:5.6.1-37.0.7.3.legacy
- integrate new tmpfile patch from OWL/solar designer
- add BuildRequires: db1-devel db3-devel
      BuildRequires: glibc-devel gdbm-devel gpm-devel libjpeg-devel
      BuildRequires: libpng-devel libtiff-devel ncurses-devel popt
      BuildRequires: zlib-devel binutils libelf e2fsprogs-devel pam pwdb
      BuildRequires: rpm-devel

rh9:
* Thu Dec 29 2005 David Eisenstein <deisenst at gtw.net> 2:5.8.0-90.0.12.legacy
- Add BuildRequires: libacl-devel, libcap-devel.  This provides missing
  .ph header files sys/acl.ph and sys/capability.ph.

* Fri Dec 23 2005 David Eisenstein <deisenst at gtw.net> 2:5.8.0-90.0.11.legacy
- Add BuildRequires: byacc elfutils-devel
- Since this is being build in mach, we cannot use the "trick" that Red Hat
  used (of running rpm -q in the build process) to generate the list of
files
  from which *.ph files are pulled.  So instead, there are two static files
  which list the same thing, Source13 and Source14.  These two files may
need
  to be refreshed when rebuilding again.

* Sat Oct 22 2005 David Eisenstein <deisenst at gtw.net> 2:5.8.0-90.0.10.legacy
- Update perl-5.8.0-tempfile-5.8.3-backport.patch to correct some errors.
- Bugzilla #152845

* Thu Jul 14 2005 John Dalbec <jpdalbec at ysu.edu> 2:5.8.0-90.0.9.legacy
- integrate fixes for CAN-2004-0452 CAN-2005-0077 CAN-2005-0155
CAN-2005-0156
  CAN-2005-0448 and a CGI.pm DoS.

* Thu Dec 9 2004 John Dalbec <jpdalbec at ysu.edu> 2:5.8.0-89.0.9.legacy
- integrate tmpfile patch from OWL/solar designer
- add BuildRequires: glibc-devel gdbm-devel gpm-devel libjpeg-devel
      BuildRequires: libpng-devel libtiff-devel ncurses-devel popt
      BuildRequires: zlib-devel binutils e2fsprogs-devel pam
      BuildRequires: rpm-devel groff

fc1:
* Tue Dec 27 2005 David Eisenstein <deisenst at gtw.net> 3:5.8.3-17.4.legacy
- Added BuildRequires:  byacc, groff

* Sun Sep 19 2005 David Eisenstein <deisenst at gtw.net> 3:5.8.3-17.3.legacy
- Remove patch1005: perl-5.8.3-cgi.pm.patch introduces a bug and is
  unnecessary.  See bug # 152845 comment 9.

* Tue Sep 13 2005 David Eisenstein <deisenst at gtw.net> 3:5.8.3-17.2.legacy
- Re-do version number for FC1 release so as not to conflict with FC2.
- Put whitespace back to make an easier compare with 5.8.3-16
- Remove patch for CAN-2005-0077 since it patches perl-DBI package,
  not this one.

* Thu Jul 14 2005 John Dalbec <jpdalbec at ysu.edu> 3:5.8.3-18.1.legacy
- integrate fixes for CAN-2004-0452 CAN-2005-0077 CAN-2005-0155
CAN-2005-0156
  CAN-2005-0448 and a CGI.pm DoS.

* Thu Dec 9 2004 John Dalbec <jpdalbec at ysu.edu> 3:5.8.3-17.1.legacy
- integrate tmpfile patch from OWL/solar designer

fc2:
* Wed Dec 28 2005 David Eisenstein <deisenst at gtw.net> 3:5.8.3-19.3.legacy
- Added BuildRequires:  byacc, groff

* Wed Nov 23 2005 John Dalbec <jpdalbec at ysu.edu> 3:5.8.3-19.2.legacy
- integrate tmpfile patch from OWL/solar designer
- integrate fixes for CAN-2004-0452 CAN-2005-0155 CAN-2005-0156 and
  CAN-2005-0448.

---------------------------------------------------------------------
This update can be downloaded from:
  http://download.fedoralegacy.org/
(sha1sums)

rh73:
ac3b7161e09878545dc1e499ad4d1c1de5cf8a42
redhat/7.3/updates-testing/i386/perl-5.6.1-38.0.7.3.3.legacy.i386.rpm
d5d8c6c4b2b77fc14b0720dcad3c799f3dfdf759
redhat/7.3/updates-testing/i386/perl-CGI-2.752-38.0.7.3.3.legacy.i386.rpm
c0a405c744e2b047fefd9e189da08f84433538d4
redhat/7.3/updates-testing/i386/perl-CPAN-1.59_54-38.0.7.3.3.legacy.i386.rpm
9380974623d1c7e9283823cc6a300c1486cb1052
redhat/7.3/updates-testing/i386/perl-DB_File-1.75-38.0.7.3.3.legacy.i386.rpm
0b1c087c7aa5d97118e84e471fe154599104260f
redhat/7.3/updates-testing/i386/perl-NDBM_File-1.75-38.0.7.3.3.legacy.i386.rpm
28c36210be8c7207264fc2b55cdcedf7d1e4bb80
redhat/7.3/updates-testing/i386/perl-suidperl-5.6.1-38.0.7.3.3.legacy.i386.rpm
41fe2199272ab4d601634650be781753d391d750
redhat/7.3/updates-testing/SRPMS/perl-5.6.1-38.0.7.3.3.legacy.src.rpm

rh9:
d889ae85e1585e93aa76cd67edab80a2c1f0e076
redhat/9/updates-testing/i386/perl-5.8.0-90.0.12.legacy.i386.rpm
0615bbecd89001917ef70e0a60f20d5c5c50a732
redhat/9/updates-testing/i386/perl-CGI-2.81-90.0.12.legacy.i386.rpm
9b06404d6d324b322fc5f959d78d678e3dc823e9
redhat/9/updates-testing/i386/perl-CPAN-1.61-90.0.12.legacy.i386.rpm
05234d09cec06556e3208efe95363bf3b07100d1
redhat/9/updates-testing/i386/perl-DB_File-1.804-90.0.12.legacy.i386.rpm
bfa538993bf4554703fd25dcb44e06a8aeb75484
redhat/9/updates-testing/i386/perl-suidperl-5.8.0-90.0.12.legacy.i386.rpm
d73eb66c03bf06bea9fb861c33de5bc0484e2b9f
redhat/9/updates-testing/SRPMS/perl-5.8.0-90.0.12.legacy.src.rpm

fc1:
3211332bad74a6965dac37a726d46dba88adc226
fedora/1/updates-testing/i386/perl-5.8.3-17.4.legacy.i386.rpm
156099d6f6f56bd1c8a0db137e2ee3c66104771e
fedora/1/updates-testing/i386/perl-suidperl-5.8.3-17.4.legacy.i386.rpm
3f5ffa320347a2cc9e98219a57a637da5e2b08f8
fedora/1/updates-testing/SRPMS/perl-5.8.3-17.4.legacy.src.rpm

fc2:
6c43d3e838f4edb74a120134455990725b589b89
fedora/2/updates-testing/i386/perl-5.8.3-19.3.legacy.i386.rpm
561aa026e227438489430b8c245439fada4cc23f
fedora/2/updates-testing/i386/perl-suidperl-5.8.3-19.3.legacy.i386.rpm
56cd349370c7c83e9c25b8207dd114b5169898a9
fedora/2/updates-testing/SRPMS/perl-5.8.3-19.3.legacy.src.rpm

---------------------------------------------------------------------

Please test and comment in bugzilla.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/fedora-legacy-list/attachments/20060109/09994f85/attachment.sig>