https://bugzilla.redhat.com/show_bug.cgi?id=2512057
Bug ID: 2512057
Summary: CVE-2026-12844 perl-List-SomeUtils-XS:
List::SomeUtils::XS: Heap buffer overflow in
pairwise() function leading to arbitrary code
execution [fedora-all]
Product: Fedora
Version: rawhide
Status: NEW
Whiteboard: {"flaws": ["3d6eb120-fbc6-4344-b275-dc12019a7418"]}
Component: perl-List-SomeUtils-XS
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected],
[email protected]
Blocks: 2492973 (CVE-2026-12844)
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow
in the pairwise function.
pairwise() collects the values returned by the block into a heap buffer sized
to the longer input array, then grows the buffer before each copy with a single
quadrupling (alloc <<= 2) instead of a loop. A block call that returns more
than four times the current allocation in one invocation outgrows that one
quadrupling, and the copy writes past the end of the buffer.
Any caller of pairwise() whose block returns, for a single pair, more than four
times the longer input array's length writes past the buffer and corrupts the
heap.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2492973
[Bug 2492973] CVE-2026-12844 perl-List-SomeUtils-XS: List::SomeUtils::XS: Heap
buffer overflow in pairwise() function leading to arbitrary code execution
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2512057
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-spam&short_desc=Report%20of%20Bug%202512057%23c0
--
_______________________________________________
perl-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
