Your message dated Wed, 02 Sep 2026 21:17:08 +0000
with message-id <[email protected]>
and subject line Bug#1146063: fixed in libsocket-perl 2.038-1+deb13u1
has caused the Debian Bug report #1146063,
regarding perl: CVE-2026-12087
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1146063: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146063
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: perl
Version: 5.40.1-8
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for perl.
CVE-2026-12087[0]:
| Socket versions before 2.041 for Perl have an out-of-bounds heap
| read. In Socket.xs, pack_ip_mreq_source() checks the length of its
| source argument before the argument is read, so the check tests the
| byte length carried over from the preceding multiaddr argument
| instead. Both addresses occupy a 4-byte field, so a valid multiaddr
| lets a source of any length pass the check, and the source is then
| copied into the 4-byte imr_sourceaddr field with a fixed-size copy.
| A source shorter than 4 bytes is not rejected, and the copy reads up
| to 3 bytes past the end of its buffer. Calling
| pack_ip_mreq_source() with a source value shorter than 4 bytes
| copies adjacent heap memory into the returned packed structure.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-12087
https://www.cve.org/CVERecord?id=CVE-2026-12087
[1] https://lists.security.metacpan.org/cve-announce/msg/41020451/
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: libsocket-perl
Source-Version: 2.038-1+deb13u1
Done: gregor herrmann <[email protected]>
We believe that the bug you reported is fixed in the latest version of
libsocket-perl, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
gregor herrmann <[email protected]> (supplier of updated libsocket-perl package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 31 Aug 2026 15:46:55 +0200
Source: libsocket-perl
Architecture: source
Version: 2.038-1+deb13u1
Distribution: trixie
Urgency: medium
Maintainer: Debian Perl Group <[email protected]>
Changed-By: gregor herrmann <[email protected]>
Closes: 1146063
Changes:
libsocket-perl (2.038-1+deb13u1) trixie; urgency=medium
.
[ Kentaro Hayashi ]
* Backport patch to fix CVE-2026-12087
(out-of-bounds heap read in pack_ip_mreq_source()).
- Added CVE-2026-12087.patch
- Added CVE-2026-12087-test.patch for testing
.
Closes: #1146063
Checksums-Sha1:
114c6308e2fabb665309cb7435a99cad2a98ae0c 2371
libsocket-perl_2.038-1+deb13u1.dsc
e4ffe85b2db57cd63dd28262485ca6166ddb78a6 5520
libsocket-perl_2.038-1+deb13u1.debian.tar.xz
Checksums-Sha256:
76c5799c8595ae9fad29a0035e738af8dbab32168e203187575f3bdc59291245 2371
libsocket-perl_2.038-1+deb13u1.dsc
bd88adf8f43a47b55919d8a96a4f7f4c0606ea7a1ecc7ca7c6d7c58918e067c9 5520
libsocket-perl_2.038-1+deb13u1.debian.tar.xz
Files:
97631007f2a3d7377378298b3ddf38b1 2371 perl optional
libsocket-perl_2.038-1+deb13u1.dsc
73bf80b87f80661232148fe5f95ccda9 5520 perl optional
libsocket-perl_2.038-1+deb13u1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEE0eExbpOnYKgQTYX6uzpoAYZJqgYFAmqXSHZfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEQx
RTEzMTZFOTNBNzYwQTgxMDREODVGQUJCM0E2ODAxODY0OUFBMDYACgkQuzpoAYZJ
qgab7w//Q/ZtVfPVSfELpdFMTuFFpQt6PFdYKnR5/v7W7B3nZWj8eXU/3l1UR23r
22UACCSxZj0zLijMcjPD91psm9YPIRwosW+kqyBPGjjAW0YHpADK6TnQMo0z3ZIr
Fs5MAKLboXlBuSHplKOAP7mJE7atlPWoO3Rr0VY3PIU824NVAJ0PCeTMq+MbN2t+
AiElgVNAvXXZpu2DvaHXr/7krOmqdreU+R6ZACfFVolYgbUeHCExnak6+emCSdTj
ibSHxNwDx0ZTuGqhHA+xSqAOX1+ZC3dNmII409KWLa40Eq/gwkMGrAFHnscBraVF
zyvbZ9z18Vk2JbE+cwuXsrgvreo/uLsNIkDm1sQ96fjIwzWeX/tnLnsCXVF9+fF5
IzkTIkj6qoXyGN3vQNJvcU+LTaR1KzHIhqpV9li4kFhIrggxOcgsb5m+ZBXC9h3j
7QGzTzYOy5SHT99kzCpgcrAFZtTL4mH3B8U88aJAUsnTRr9o0zKSRsoST8rEWHaw
/xvV6kbZNVsWPOqiF2U1jkl+SyvhTR+wt86MaSu0+Y/OMTMAdEOqV4z+rSWK95zJ
KkstIEFNc5Byzr6hgajdTyQ6FpBy5PSS+XYw0o0DWUZmXpiafcOBOQvcHQIwPw/K
Vh4hkB4HgtRBRPPscUtg1542NvIF+bTxkpi97xSx/8J+cafn4RI=
=G3Uu
-----END PGP SIGNATURE-----
pgpAQUQuRD6P7.pgp
Description: PGP signature
--- End Message ---
