[Secure-testing-team] Bug#875596: perl: CVE-2017-12837: Heap buffer overflow in regular expression compiler

[Salvatore Bonaccorso]

Source: perl
Version: 5.20.2-1
Severity: grave
Tags: security upstream patch
Forwarded: https://rt.perl.org/Public/Bug/Display.html?id=131582

Hi,

the following vulnerability was published for perl.

CVE-2017-12837[0]:
Heap buffer overflow in regular expression compiler

>From release notes: 

Compiling certain regular expression patterns with the case-insensitive
modifier could cause a heap buffer overflow and crash perl.  This has now been
fixed.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-12837
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12837
[1] https://rt.perl.org/Public/Bug/Display.html?id=131582 (not yet public)

Regards,
Salvatore