Bug#832440: libintl-perl: CVE-2016-1238 fix

2016-08-07 Thread Dominic Hargreaves
On Sun, Aug 07, 2016 at 04:40:56PM -0400, Peter Eisentraut wrote: > On 8/4/16 12:06 PM, Dominic Hargreaves wrote: > >> if ($no_xs) { > >> > +local @INC = @INC; > >> > +pop @INC if $INC[-1] eq '.'; > >> > eval { > >> > require POSIX; > >> > # void > > This 'local @INC'

Bug#832440: libintl-perl: CVE-2016-1238 fix

2016-08-07 Thread Peter Eisentraut
On 8/4/16 12:06 PM, Dominic Hargreaves wrote: >> if ($no_xs) { >> > +local @INC = @INC; >> > +pop @INC if $INC[-1] eq '.'; >> > eval { >> > require POSIX; >> > # void > This 'local @INC' should I believe reside within the eval block. No, it applies to the requires af

Bug#832440: libintl-perl: CVE-2016-1238 fix

2016-08-04 Thread Dominic Hargreaves
On Tue, Jul 26, 2016 at 02:40:06PM -0400, Peter Eisentraut wrote: > On 7/25/16 10:45 AM, Dominic Hargreaves wrote: > > Package: libintl-perl > > Version: 1.24-1 > > Severity: important > > > > Hi maintainer, > > > > An update for this package has been released as part of our handling for > > the

Bug#832440: libintl-perl: CVE-2016-1238 fix

2016-07-26 Thread Peter Eisentraut
On 7/25/16 10:45 AM, Dominic Hargreaves wrote: > Package: libintl-perl > Version: 1.24-1 > Severity: important > > Hi maintainer, > > An update for this package has been released as part of our handling for > the issue described below. This fixes an instance of the dynamic module > loading vulner

Bug#832440: libintl-perl: CVE-2016-1238 fix

2016-07-25 Thread Dominic Hargreaves
Package: libintl-perl Version: 1.24-1 Severity: important Hi maintainer, An update for this package has been released as part of our handling for the issue described below. This fixes an instance of the dynamic module loading vulnerability alluded to. I attach the patch I applied for jessie; ple