Ubuntu alert USN-8675-1 (perl)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8675-1] Perl vulnerabilities
Date:
             
 
Tue, 25 Aug 2026 19:47:45 +0000
Message-ID:
             
 
<E1wyx7Z-00081t-6s@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8675-1
August 25, 2026

perl vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in Perl.

Software Description:
- perl: Practical Extraction and Report Language

Details:

It was discovered that Perl incorrectly handled short source addresses
in the Socket module. An attacker could possibly use this issue to
trigger an out-of-bounds heap read, resulting in information disclosure.
(CVE-2026-12087)

It was discovered that Perl incorrectly handled regular expressions
containing a large number of fixed string alternatives. An attacker
could possibly use this issue to cause incorrect regular expression
matches, resulting in security restrictions being bypassed.
(CVE-2026-13221)

It was discovered that Perl incorrectly handled certain large repeat
counts when processing pack and unpack templates. An attacker could
possibly use this issue to trigger an out-of-bounds heap read, resulting
in information disclosure. (CVE-2026-57432)

It was discovered that Perl incorrectly handled certain crafted data
when deserializing with the Storable module. An attacker could possibly
use this issue to trigger an integer overflow and application
termination, resulting in a denial of service. (CVE-2026-57433)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS
  libperl5.34                     5.34.0-3ubuntu1.8
  perl-base                       5.34.0-3ubuntu1.8
  perl-modules-5.34               5.34.0-3ubuntu1.8

Ubuntu 20.04 LTS
  libperl5.30                     5.30.0-9ubuntu0.5+esm3
                                  Available with Ubuntu Pro
  perl-base                       5.30.0-9ubuntu0.5+esm3
                                  Available with Ubuntu Pro
  perl-modules-5.30               5.30.0-9ubuntu0.5+esm3
                                  Available with Ubuntu Pro

Ubuntu 18.04 LTS
  libperl5.26                     5.26.1-6ubuntu0.7+esm3
                                  Available with Ubuntu Pro
  perl-base                       5.26.1-6ubuntu0.7+esm3
                                  Available with Ubuntu Pro
  perl-modules-5.26               5.26.1-6ubuntu0.7+esm3
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  libperl5.22                     5.22.1-9ubuntu0.9+esm3
                                  Available with Ubuntu Pro
  perl-base                       5.22.1-9ubuntu0.9+esm3
                                  Available with Ubuntu Pro
  perl-modules-5.22               5.22.1-9ubuntu0.9+esm3
                                  Available with Ubuntu Pro

Ubuntu 14.04 LTS
  libperl5.18                     5.18.2-2ubuntu1.7+esm8
                                  Available with Ubuntu Pro
  perl-base                       5.18.2-2ubuntu1.7+esm8
                                  Available with Ubuntu Pro
  perl-modules                    5.18.2-2ubuntu1.7+esm8
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8675-1
  CVE-2026-12087, CVE-2026-13221, CVE-2026-57432, CVE-2026-57433

Package Information:
  https://launchpad.net/ubuntu/+source/perl/5.34.0-3ubuntu1.8


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIyBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmqN8RYACgkQcpJm3tlz
hgHkPw/3VxwV5Mox2m1M7EYIp42k/ECH/Gl1kNQIms9VGBMXzS6MIDuPHIZammPQ
dqpucQWxxUnBCVu9VDR0HstkCtul0lHGT+jqqqXRvKJ6IO37+IHBnknvcRquvTOy
86gGkpyG1i+dkMMqEJ/STG+/Om97QeAIGQI9HUqc2LJcJEugHnyAoY3evqFAexku
eX8KtQEArRZJ5kr26bHnJNq0aiNMfPgExIYZ6JBCvrQqEb56n5ppDW/fGoxgJssc
gwdJRCFaTBOBFQxS2wUCaNVkoBQXxbz22ywskZWKZnsOtZjc6PxQZToGRKPK4zg6
4Nv1mVaR0CLJuVGOCa6DjIPq2jciREe1CESnjBh1c2JkwM5CUa+L5z+mVXK7Ue5e
5HpRQut4ujRgSdo/PE/qtBts9F2MIcl51WSHWimfFwNzgjOHpp1h67P/wOVKlFYe
vnEAna/k0M4260IdDVscA0C9uosSsU68f1AgCK/Sk2WzlGtJ/44Hy5b2Pp5cdSBW
xGxCUlLVX7033JOGpl0W6l15AhqTwP7DkvVbzeMGoeWXzjd6rdf90rdAveNaJ9Ux
xJmK0FkJ0HRJ98QodKjBu01eXizu7BBMb0jpaleoqFknQC4netAVkkrzjkSIV1lN
LZnBX9ZGJ40jLdMO4ttXUma2mvIA/4s67NOvGQ2AkCGRMx6MtQ==
=E/qL
-----END PGP SIGNATURE-----