Updated Perl packages for Red Hat Linux has been released
Perl is a high-level programming language commonly used for system administration utilities and Web programming.Read more
Two security issues have been found in Perl that affect the Perl packages shipped with Red Hat Linux:
When safe.pm versions 2.0.7 and earlier are used with Perl 5.8.0 and earlier, it is possible for an attacker to break out of safe compartments within Safe::reval and Safe::rdo by using a redefined @_ variable. This is due to the fact that the redefined @_ variable is not reset between successive calls. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-1323 to this issue. NOTE: This issue does not affect the Perl packages which shipped with Red Hat Linux 9.
A cross-site scripting vulnerability was discovered in the start_form() function of CGI.pm. The vulnerability allows a remote attacker to insert a Web script via a URL fed into the form's action parameter. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0615 to this issue.
Users of Perl are advised to upgrade to the packages contained within this erratum. For Red Hat Linux 7.1, 7.2, and 7.3, Perl version 5.6.1 contains backported security patches addressing these issues. For Red Hat Linux 8.0 and 9, Perl version 5.8.0 is supplied, which is not vulnerable to issue CAN-2003-1323 and which contains a backported security patch addressing issue CAN-2003-0615.
