Most recent entries from all

ALSA-2026:30851 — Important: perl:5.32 security update

Affected: AlmaLinux:8: perl, AlmaLinux:8: perl-Algorithm-Diff, AlmaLinux:8: perl-Archive-Tar, AlmaLinux:8: perl-Archive-Zip, AlmaLinux:8: perl-Attribute-Handlers, AlmaLinux:8: perl-AutoLoader, AlmaLinux:8: perl-AutoSplit, AlmaLinux:8: perl-B, AlmaLinux:8: perl-Benchmark, AlmaLinux:8: perl-CPAN and 212 more

Perl is a high-level programming language that is commonly used for system administration utilities and web programming.

Security Fix(es):

* perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access (CVE-2026-42496) * perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob (CVE-2026-48962)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

BELL-CVE-2026-48962

Affected: Alpaquita:23: perl, Alpaquita:25: perl, Alpaquita:stream: perl, BellSoft Hardened Containers:23: perl, BellSoft Hardened Containers:25: perl, BellSoft Hardened Containers:stream: perl

certfr-2026-avi-0731 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Certaines d'entre elles permettent à un at…

certfr-2026-avi-0731

EUVD-2026-347579

fkie_cve-2026-48962

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.

_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.

Arbitrary Perl in the output glob executes at the calling process's privilege.

GHSA-q6wx-vhvq-x7h6

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.

Arbitrary Perl in the output glob executes at the calling process's privilege.

msrc_CVE-2026-48962 — IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled o…

msrc_CVE-2026-48962

NCSC-2026-0321 — Meerdere kwetsbaarheden verholpen in IBM AIX en IBM PowerVM VIOS

NCSC-2026-0321

OESA-2026-2610 — perl-IO-Compress security update

Affected: openEuler:24.03-LTS-SP3: perl-IO-Compress

This distribution provides a Perl interface to allow reading and writing of compressed data created with the zlib and bzip2 libraries. Security Fix(es):

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.

Arbitrary Perl in the output glob executes at the calling process's privilege.(CVE-2026-48962)

openSUSE-SU-2026:10939-1 — perl-IO-Compress-2.220.0-1.1 on GA media

perl-IO-Compress-2.220.0-1.1 on GA media

RHSA-2026:29182 — Red Hat Security Advisory: perl-IO-Compress security update

perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob

RLSA-2026:30851 — Important: perl:5.32 security update

Affected: Rocky Linux:8: perl, Rocky Linux:8: perl-Algorithm-Diff, Rocky Linux:8: perl-Archive-Zip, Rocky Linux:8: perl-autodie, Rocky Linux:8: perl-bignum, Rocky Linux:8: perl-Carp, Rocky Linux:8: perl-Compress-Bzip2, Rocky Linux:8: perl-Compress-Raw-Bzip2, Rocky Linux:8: perl-Compress-Raw-Lzma, Rocky Linux:8: perl-Compress-Raw-Zlib and 101 more

Perl is a high-level programming language that is commonly used for system administration utilities and web programming.

Security Fix(es):

* perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access (CVE-2026-42496)

* perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob (CVE-2026-48962)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

UBUNTU-CVE-2026-48962

Affected: Ubuntu:Pro:14.04:LTS: perl, Ubuntu:Pro:16.04:LTS: perl, Ubuntu:16.04:LTS: libio-compress-perl, Ubuntu:Pro:18.04:LTS: perl, Ubuntu:18.04:LTS: libio-compress-perl, Ubuntu:Pro:20.04:LTS: perl, Ubuntu:20.04:LTS: libio-compress-perl, Ubuntu:22.04:LTS: libio-compress-perl, Ubuntu:22.04:LTS: perl, Ubuntu:24.04:LTS: libio-compress-perl and 5 more

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.

WID-SEC-W-2026-2063 — Red Hat Enterprise Linux (perl-IO-Compress): Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rec…

Ein lokaler Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen.