-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 30 Aug 2026 11:53:55 +0300
Source: perl
Binary: libperl-dev libperl5.40 perl perl-base perl-debug
Architecture: amd64
Version: 5.40.1-6+deb13u1
Distribution: trixie
Urgency: medium
Maintainer: amd64 / i386 Build Daemon (x86-ubc-02) <buildd_amd64-x86-ubc-02@buildd.debian.org>
Changed-By: Niko Tyni <ntyni@debian.org>
Description:
 libperl-dev - Perl library: development files
 libperl5.40 - shared Perl library
 perl       - Larry Wall's Practical Extraction and Report Language
 perl-base  - minimal Perl system
 perl-debug - debug-enabled Perl interpreter
Closes: 1137345 1138854 1138855 1138856 1138858 1138859 1138860 1138863 1138905 1138906 1140152 1141639 1142037
Changes:
 perl (5.40.1-6+deb13u1) trixie; urgency=medium
 .
   * [SECURITY] various upstream fixes:
     + CVE-2026-7017: HTTP::Tiny credential forwarding on redirects.
         (Closes: #1141639)
     + CVE-2026-42496: Archive::Tar symlink extraction.
         (Closes: #1138860)
     + CVE-2026-42497: Archive::Tar hardlink extraction.
         (Closes: #1138859)
     + CVE-2026-12087: Socket: pack_ip_mreq_source() out-of-bounds heap read.
         (Closes: #1140152)
     + CVE-2026-13221: silently incorrect regular expression matches.
         (Closes: #1142037)
     + CVE-2025-15649: header parsing in IO::Uncompress::Unzip.
         (Closes: #1138863)
     + CVE-2026-7010:  CRLF-validation in HTTP::Tiny.
         (Closes: #1138858)
     + CVE-2026-8376:  Buffer overflow in Perl_study_chunk.
         (Closes: #1137345)
     + CVE-2026-48959: CPU exhaustion in IO::Uncompress::Unzip.
         (Closes: #1138856)
     + CVE-2026-48961: crash in zipdetails.
         (Closes: #1138855)
     + CVE-2026-48962: code execution in IO-Compress via output globs.
         (Closes: #1138854)
     + CVE-2026-57432: out of bound heap reads in pack() and unpack().
          (Closes: #1138905)
     + CVE-2026-57433: signed integer overflow in Storable.
          (Closes: #1138906)
Checksums-Sha1:
 b41909426368a16d52be638ca7bfb2dad2fb7ab5 1112168 libperl-dev_5.40.1-6+deb13u1_amd64.deb
 af4cd0adb0e67e6e30e04a39ff617d94cc05fc77 4325996 libperl5.40_5.40.1-6+deb13u1_amd64.deb
 e08e47a606c27af0d1f47901b1d75beec5282bbb 1666320 perl-base_5.40.1-6+deb13u1_amd64.deb
 19bc589a4a9b1df3e06309d309e7671a806ecc8b 13465996 perl-debug_5.40.1-6+deb13u1_amd64.deb
 ddbe7f514d3c6d42887c35b2c33fe9c69dee1dce 7164 perl_5.40.1-6+deb13u1_amd64-buildd.buildinfo
 5a70387ff0f86c1336fe17ce0c6adb1620d20a6c 267736 perl_5.40.1-6+deb13u1_amd64.deb
Checksums-Sha256:
 862249a3dd579c01c54f3807e0884fbb05091fd8d1601ae546001c96278437ef 1112168 libperl-dev_5.40.1-6+deb13u1_amd64.deb
 e44777ff47ad248d1debd57e1f96ab5e89061a341008ae39880ba3b5fc15f273 4325996 libperl5.40_5.40.1-6+deb13u1_amd64.deb
 b795464137a0f4d443fc9284f4b93e883fb83883cb533adf300ac660807a352a 1666320 perl-base_5.40.1-6+deb13u1_amd64.deb
 759f9f4e8a74ffd225e9aee21c17c53cb84d53b1cd0878235a804fd01b050312 13465996 perl-debug_5.40.1-6+deb13u1_amd64.deb
 e2df3a337e5798b9fd066b4e8005a83850244242800e9b575c4edc512a2a4412 7164 perl_5.40.1-6+deb13u1_amd64-buildd.buildinfo
 ef145c247787d6f40dcdefd5b417502484827cde0d555998c17fd5b27ec1e1dd 267736 perl_5.40.1-6+deb13u1_amd64.deb
Files:
 e0a903a196842e01d76cbc369048ca30 1112168 libdevel optional libperl-dev_5.40.1-6+deb13u1_amd64.deb
 f2c39e14463dcaa069bf73120cdc8279 4325996 libs optional libperl5.40_5.40.1-6+deb13u1_amd64.deb
 bb99bd2a5be201fd258fe19ca8d9f6ce 1666320 perl required perl-base_5.40.1-6+deb13u1_amd64.deb
 56519adf41933a86f665aab86448d26a 13465996 devel optional perl-debug_5.40.1-6+deb13u1_amd64.deb
 3b3d56b59482fdfe8bfa137f8700fde8 7164 perl standard perl_5.40.1-6+deb13u1_amd64-buildd.buildinfo
 fe29dbce2114537b3b7e8cc763252597 267736 perl standard perl_5.40.1-6+deb13u1_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEb5EwsJvHBEjqIJYIbheoBegwXLIFAmqZPAUACgkQbheoBegw
XLKQkw//aT5FEbbd17SCQDmU0Hlpt1HATuCNGsB3624Sb0ltrYrHSE2GIvMS3q3x
i/T37QBu4ZWlwOr3K1VDZEHDN6TZEle1pNZI09oD7YQjuLX+Iad3hdcANWDzeZ7N
hdsjoS8JzU4N7vxPrMMIoLEOikO3/EsDbqZRatsfsfCfyb+AqZYtW8ZebvpSrCVP
dbN4rU8e7TegmkA0gc6d6HeLbNNOYCj2k6WiInsmEO1zNo4ZwOUZKrXUKvoxZTgI
2BxN9tkOweZZHDYA7jS/ErUun1WN5SoJRDN+VUUfebCx367Gbs/QX5uiJ9MzLPap
/XJt/lRX6glJi10ilELILORKyV98LgVZd0yMgblatuUFFoPwE4GKu5lCjT4OECrL
UeKS3zNJp+5/FMbvSfy8bGrKCAaQ+vmv+7h8KZh7YGhThU+cOAcv4ztQYSiwJSec
ThwU6mzZvN2BylO/Yy5Y46wA4M012pW0oDfIq65juyjy45+FNu0gKfKZWLVJAwXq
mnGSTuMvEm87cUTYHZ2eG8TOM3B8ZP4ShfOjxucSlXI87EIOslVLUxhti/iygNwl
9IsmsJN/+htng1r1EreCSTJVyiPuOZQLgX3/iFd+X8olYt/Wrq0IfCduLZW9ZCrk
YTEwdqpZLKUgK1oNmIgYXkLVic/B6dMb5RS+HNHEhWXGY9xpws0=
=4ju4
-----END PGP SIGNATURE-----