EULEROS-SA-2026-2864

Summary:

An update for perl is now available for EulerOS Virtualization release 2.10.0

EulerOS Security has rated this update as having a security impact of Critical.A Common Vunlnerability Scoring System(CVSS)base score, which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.General:

Perl is a high-level programming language with roots in C, sed, awk and shell scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most common applications are system administration utilities and web programming. This is a metapackage with all the Perl bits and core modules that can be found in the upstream tarball from perl.org. If you need only a specific feature, you can install a specific package instead. E.g. to handle Perl scripts with /usr/bin/perl interpreter, install perl-interpreter package. See perl-interpreter description for more details on the Perl decomposition into packages.

Security Fix(es):

Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.(CVE-2026-8376)Legal Disclaimer:

This document is provided on an "AS IS" basis and does not imply any kind of guarantee or warranty, either express or implied, including the warranties of merchantability or fitness for a particular purpose. In no event shall...