[SECURITY] perl: CVE-2016-2381

[SECURITY] perl: CVE-2016-2381

[Yaakov Selkowitz]

Achim,

A security vulnerability has been made public for perl:

https://bugzilla.redhat.com/show_bug.cgi?id=1309214
http://pkgs.fedoraproject.org/cgit/rpms/perl.git/plain/perl-5.23.8-remove-duplicate-environment-variables-from-environ.patch?h=f23

-- 
Yaakov

Re: [SECURITY] perl: CVE-2016-2381

[Achim Gratz]

Yaakov Selkowitz writes:
> A security vulnerability has been made public for perl:

I've asked on p5p what the plan is for another 5.22 release.  If that's
too far off, I'll just patch 5.22.1, otherwise I'll wait for these
patches (there are more fixes on the branch) to be released in 5.22.2.


Regards,
Achim.
-- 
+<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+

SD adaptation for Waldorf rackAttack V1.04R1:
http://Synth.Stromeko.net/Downloads.html#WaldorfSDada

Re: [SECURITY] perl: CVE-2016-2381

[Achim Gratz]

Achim Gratz writes:
> Yaakov Selkowitz writes:
>> A security vulnerability has been made public for perl:
>
> I've asked on p5p what the plan is for another 5.22 release.  If that's
> too far off, I'll just patch 5.22.1, otherwise I'll wait for these
> patches (there are more fixes on the branch) to be released in 5.22.2.

The answer is that a release will happen "hoepfully before May", so
unless that shifts even further out I'd be inclined to wait for the
release.


Regards,
Achim.
-- 
+<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+

Wavetables for the Terratec KOMPLEXER:
http://Synth.Stromeko.net/Downloads.html#KomplexerWaves

Re: [SECURITY] perl: CVE-2016-2381

[Yaakov Selkowitz]

On 2016-03-08 11:59, Achim Gratz wrote:
> Achim Gratz writes:
>> Yaakov Selkowitz writes:
>>> A security vulnerability has been made public for perl:
>>
>> I've asked on p5p what the plan is for another 5.22 release.  If that's
>> too far off, I'll just patch 5.22.1, otherwise I'll wait for these
>> patches (there are more fixes on the branch) to be released in 5.22.2.
>
> The answer is that a release will happen "hoepfully before May", so
> unless that shifts even further out I'd be inclined to wait for the
> release.

That's way too long to leave a public vulnerability unpatched.  Please 
ship a 5.22.1-2 in the meantime.

-- 
Yaakov