Ubuntu alert USN-7678-1 (perl)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-7678-1] Perl vulnerability
Date:
             
 
Tue, 29 Jul 2025 16:29:45 +0000
Message-ID:
             
 
<E1ugnCz-0004ue-R0@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-7678-1
July 29, 2025

perl vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 25.04
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

Perl could be made to target unintended paths when performing file
operations.

Software Description:
- perl: Practical Extraction and Report Language

Details:

It was discovered that Perl threads incorrectly handled certain file
operations. A local attacker could possibly use this issue to load code or
access files from unexpected locations.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.04
  perl                            5.40.1-2ubuntu0.2

Ubuntu 24.04 LTS
  perl                            5.38.2-3.2ubuntu0.2

Ubuntu 22.04 LTS
  perl                            5.34.0-3ubuntu1.5

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-7678-1
  CVE-2025-40909

Package Information:
  https://launchpad.net/ubuntu/+source/perl/5.40.1-2ubuntu0.2
  https://launchpad.net/ubuntu/+source/perl/5.38.2-3.2ubunt...
  https://launchpad.net/ubuntu/+source/perl/5.34.0-3ubuntu1.5


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmiI9ugACgkQcpJm3tlz
hgHpzhAA1gb0sZP/VHgIyDYpLGfIXrvn1bq4wauTuAXKVl2GbjyoILlleHO3zi3e
07hDsJug1kxR2hryOFwaZN311DkzJf7GJ53Zo02cmDuEgyDzlSY1yXfcwn7DLsdA
8dI1X4jt6G1T2/JXyyXeW7iebcJCp4JPpB5pAY6xgfuOZ1k369Bd37gtt8a4Japc
XK/yp1AXNY9LtN4t6DcDU9lliA6qZh2iSCGzRyL82zsuJcSfwAPHK+0NlycGFkYM
XZMtmkAuwJ8phQXJTaqLCuC9wOMFgQvRmxR5xkD67o62cpEkcUFp2SfvmtRILTAt
6Rk7ozDEkp2bLsqBDw1SaKcfiCnJgjRZ0t9BFjuaohiRD3Cu0ilPTWOZVdGgiI/n
vTv4yRZUBvoyQkjN0UbiUXGO7JaBHqf7mHhXOaAzx6MRYi41reVWVKIxReYz0aZw
x6DYGFSqLyPHh7IW1Fs7jtpaqcrbMkQbYiC1L8LgEBOCd7BymM2+tdNTbqHSBfe0
FvIn1UC/kF6wD3xhFQFGbVNkUj7Q8QUvcy7PGBCXldwE13K9EV7T9c+pRb7Rp0EY
6MF8ahaRIIntrlEXtxgHvu5e8gJyHP2KD0sb31ra+yHOjJQEYa4HxofvcAIYshgz
rf3fMWM4CrSTgKM5MJIMxqGCmDdum/tUcU3jCB/DNc15h9bhWtM=
=uKWu
-----END PGP SIGNATURE-----