Updated perl packages fix security vulnerabilities
Publication date: 12 Nov 2025Modification date: 12 Nov 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2023-31484 , CVE-2024-56406 , CVE-2025-40909
Description
CPAN.pm before 2.35 does not verify TLS certificates when downloading
distributions over HTTPS. (CVE-2023-31484)
Perl is vulnerable to a heap buffer overflow when transliterating
non-ASCII bytes. (CVE-2024-56406)
Perl threads have a working directory race condition where file
operations may target unintended paths. (CVE-2025-40909)
References
- https://bugs.mageia.org/show_bug.cgi?id=34209
- https://bugs.mageia.org/show_bug.cgi?id=31852
- https://www.openwall.com/lists/oss-security/2023/04/29/1
- https://ubuntu.com/security/notices/USN-6112-1
- https://openwall.com/lists/oss-security/2025/04/13/3
- https://lists.debian.org/debian-security-announce/2025/msg00064.html
- https://ubuntu.com/security/notices/USN-7434-1
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/USJDDXS5I35D7CEPDILLJIEUAZOXW7YF/
- https://www.openwall.com/lists/oss-security/2025/05/22/2
- https://www.openwall.com/lists/oss-security/2025/05/23/1
- https://openwall.com/lists/oss-security/2025/05/30/4
- https://www.openwall.com/lists/oss-security/2025/06/02/2
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-31484
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56406
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40909
SRPMS
9/core
- perl-5.36.0-1.2.mga9