Advisories » MGASA-2014-0406

Updated perl packages fix CVE-2014-4330

Publication date: 09 Oct 2014
Modification date: 09 Oct 2014
Type: security
Affected Mageia releases : 4
CVE: CVE-2014-4330

Description

Updated perl package fixes security vulnerability:

The Dumper method in Data::Dumper before 2.154, as used in Perl 5.20.1 and
earlier, allows context-dependent attackers to cause a denial of service
(stack consumption and crash) via an Array-Reference with many nested
Array-References, which triggers a large number of recursive calls to the
DD_dump function (CVE-2014-4330).

Also, the Text::Wrap version provided in perl contains a bug that can lead
to a code path that shouldn't be hit. This can lead to crashes in other
software, such as Bugzilla.

The Text::Wrap module bundled with Perl has been patched and the
Data::Dumper module bundled with Perl has been updated to fix these issues.
                

References

• https://bugs.mageia.org/show_bug.cgi?id=14170
• https://www.lsexperts.de/advisories/lse-2014-06-10.txt
• https://lists.fedoraproject.org/pipermail/package-announce/2014-September/139441.html
• https://bugs.mageia.org/show_bug.cgi?id=14098
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4330

SRPMS

4/core

• perl-5.18.1-3.2.mga4