Aggregator

perl-YAML-Syck-1.47-1.fc43

Fedora Security Advisories
1 week 1 day ago
FEDORA-2026-c8484f1afb Packages in this update:
  • perl-YAML-Syck-1.47-1.fc43
Update description:

This update addresses four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load() path on untrusted input with no special flags:

  • CVE-2026-57075 (CWE-125): Out-of-bounds read in the base64 decoder caused by signed-char indexing of the decode table on !!binary input
  • CVE-2026-57076 (CWE-416): Use-after-free of an anchor key string shared between the node and the anchors table
  • CVE-2026-57077 (CWE-125): One-byte out-of-bounds read in the lexer newline scan during block-scalar parsing (incomplete-fix follow-on to CVE-2025-11683)
  • CVE-2026-13713 (CWE-416/CWE-415): Use-after-free / double-free of an anchor node on anchor redefinition, a remote-crash DoS from a 7-byte input

There are also a few other bug-fixes included.

perl-YAML-Syck-1.47-1.el10_2

Fedora Security Advisories
1 week 1 day ago
FEDORA-EPEL-2026-8b5b8778ee Packages in this update:
  • perl-YAML-Syck-1.47-1.el10_2
Update description:

This update addresses four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load() path on untrusted input with no special flags:

  • CVE-2026-57075 (CWE-125): Out-of-bounds read in the base64 decoder caused by signed-char indexing of the decode table on !!binary input
  • CVE-2026-57076 (CWE-416): Use-after-free of an anchor key string shared between the node and the anchors table
  • CVE-2026-57077 (CWE-125): One-byte out-of-bounds read in the lexer newline scan during block-scalar parsing (incomplete-fix follow-on to CVE-2025-11683)
  • CVE-2026-13713 (CWE-416/CWE-415): Use-after-free / double-free of an anchor node on anchor redefinition, a remote-crash DoS from a 7-byte input

There are also a few other bug-fixes included.

perl-HTTP-Date-6.08-1.fc43

Fedora Security Advisories
1 week 1 day ago
FEDORA-2026-b1bdb7c518 Packages in this update:
  • perl-HTTP-Date-6.08-1.fc43
Update description:

Changes:

6.08 2026-07-09 02:04:21Z

- [SECURITY] Reject input longer than 64 characters in parse_date() to prevent quadratic regex backtracking (a denial of service) on hostile date strings. Fixes CVE-2026-14741. (Olaf Alders)

6.07 2026-06-25 15:12:09Z

- Add test with Time::Zone (GH#25) (Michal Josef Špaček) - Add test with bad Time::Zone string (GH#26) (Michal Josef Špaček) - Add tests with negative time (GH#26) (Michal Josef Špaček) - Replace all instances of \d with [0-9] in regular expressions to reject non-ASCII Unicode digits, with a regression test (GH#27) (Robert Rothenberg) - Reject malformed ISO 8601 timezones with a doubled colon (GH#31) (Olaf Alders) - Document day/month/year ordering for numeric dates (GH#32) (Olaf Alders)

perl-HTTP-Date-6.08-1.fc44

Fedora Security Advisories
1 week 1 day ago
FEDORA-2026-8cec3cbf5b Packages in this update:
  • perl-HTTP-Date-6.08-1.fc44
Update description:

Changes:

6.08 2026-07-09 02:04:21Z

- [SECURITY] Reject input longer than 64 characters in parse_date() to prevent quadratic regex backtracking (a denial of service) on hostile date strings. Fixes CVE-2026-14741. (Olaf Alders)

6.07 2026-06-25 15:12:09Z

- Add test with Time::Zone (GH#25) (Michal Josef Špaček) - Add test with bad Time::Zone string (GH#26) (Michal Josef Špaček) - Add tests with negative time (GH#26) (Michal Josef Špaček) - Replace all instances of \d with [0-9] in regular expressions to reject non-ASCII Unicode digits, with a regression test (GH#27) (Robert Rothenberg) - Reject malformed ISO 8601 timezones with a doubled colon (GH#31) (Olaf Alders) - Document day/month/year ordering for numeric dates (GH#32) (Olaf Alders)