perl (5.34.0-3ubuntu1.7) jammy-security; urgency=high

  * SECURITY UPDATE: integer overflow in regular expression compiler
    - debian/patches/CVE-2026-8376_1.patch: accept quantifier limit error
      on 32-bit architectures where the quantifier limit catches the
      oversized pattern before the overflow guard
    - CVE-2026-8376

 -- Chrisa Oikonomou <chrisa.oikonomou@canonical.com>  Mon, 23 Jun 2026 11:11:00 +0300

perl (5.34.0-3ubuntu1.6) jammy-security; urgency=high

  * SECURITY UPDATE: path traversal in Archive::Tar symlink/hardlink extraction
    - debian/patches/CVE-2026-42496.patch: validate symlink and hardlink
      targets against absolute paths and directory traversal in
      cpan/Archive-Tar/lib/Archive/Tar.pm
    - CVE-2026-42496
  * SECURITY UPDATE: integer overflow in regular expression compiler
    - debian/patches/CVE-2026-8376_1.patch: add test cases for heap buffer
      overflow via quantified fixed-string regex in t/re/pat_psycho.t
    - debian/patches/CVE-2026-8376_2.patch: add overflow check before
      fixed-string buffer allocation in regcomp.c / regcomp_study.c
    - CVE-2026-8376

 -- Chrisa Oikonomou <chrisa.oikonomou@canonical.com>  Fri, 12 Jun 2026 16:42:26 +0300

perl (5.34.0-3ubuntu1.5) jammy-security; urgency=medium

  * SECURITY UPDATE: threads race condition in file operations
    - debian/patches/fixes/CVE-2025-40909-metaconfig.diff: check for
      fdopendir in regen-configure/U/perl/d_fdopendir.U.
    - debian/patches/fixes/CVE-2025-40909-1.diff: clone dirhandles without
      fchdir in Configure, Cross/config.sh-arm-linux,
      Cross/config.sh-arm-linux-n770, Porting/Glossary, Porting/config.sh,
      config_h.SH, configure.com, plan9/config_sh.sample, sv.c,
      t/op/threads-dirh.t, win32/config.gc, win32/config.vc.
    - debian/patches/fixes/CVE-2025-40909-2.diff: minor corrections in
      Cross/config.sh-arm-linux, Cross/config.sh-arm-linux-n770,
      config_h.SH,plan9/config_sh.sample.
    - debian/patches/fixes/CVE-2025-40909-3.diff: use PerlLIO_dup_cloexec
      in Perl_dirp_dup to set O_CLOEXEC in sv.c.
    - debian/patches/fixes/CVE-2025-40909-metaconfig-reorder.diff: slightly
      reorder Configure and config_h.SH to match metaconfig output in
      Configure, config_h.SH.
    - debian/patches/fixes/CVE-2025-40909-generated.diff: update generated
      files and checksums in uconfig.sh, uconfig64.sh, uconfig.h,
      NetWare/config.wc.
    - CVE-2025-40909

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 25 Jul 2025 13:26:40 -0400

perl (5.34.0-3ubuntu1.4) jammy-security; urgency=medium

  * SECURITY UPDATE: heap overflow when transliterating non-ASCII bytes
    - debian/patches/CVE-2024-56406.patch: properly calculate needed space
      in op.c.
    - CVE-2024-56406

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 08 Apr 2025 09:21:50 -0400

perl (5.34.0-3ubuntu1.3) jammy-security; urgency=medium

  * SECURITY UPDATE: heap overflow via regular expression
    - debian/patches/CVE-2023-47038.patch: fix read/write past buffer end
      in regcomp.c, t/re/pat_advanced.t.
    - CVE-2023-47038
  * SECURITY UPDATE: infinite recursion via warning message printing
    - debian/patches/CVE-2022-48522.patch: fix warning handling in sv.c,
      t/lib/warnings/sv.
    - CVE-2022-48522

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 23 Nov 2023 09:56:46 -0500

perl (5.34.0-3ubuntu1.2) jammy-security; urgency=medium

  * SECURITY UPDATE: insecure default TLS configuration in HTTP::Tiny module
    - debian/patches/CVE-2023-31484.patch: add verify_SSL=>1 to HTTP::Tiny to
      verify https server identity.
    - CVE-2023-31484

 -- Camila Camargo de Matos <camila.camargodematos@canonical.com>  Tue, 23 May 2023 14:18:13 -0300

perl (5.34.0-3ubuntu1.1) jammy-security; urgency=medium

  * SECURITY UPDATE: Signature verification bypass
    - debian/patches/CVE-2020-16156-1.patch: signature
      verification type CANNOT_VERIFY was not recognized
      in cpan/CPAN/lib/CPAN/Distribution.pm.
    - debia/patches/CVE-2020-16156-2.patch: add two new failure modes
      in cpan/CPAN/lib/CPAN/Distribution.pm.
    - debian/patches/CVE-2020-16156-3.patch: use gpg
      to disentangle data and signature in cpan/CPAN/lib/CPAN/Distribution.pm.
    - debian/patches/CVE-2020-16156-4.patch: replacing die with mydie in
      three spots in cpan/CPAN/lib/CPAN/Distribution.pm.
    - debian/patches/CVE-2020-16156-5.patch: disambiguate the call
      to gpg --output by adding --verify in
      cpan/CPAN/lib/CPAN/Distribution.pm.
    - debian/patches/CVE-2020-16156-6.patch: corrects typo
      in cpan/CPAN/lib/CPAN/Distribution.pm.
    - debian/patches/CVE-2020-16156-7.patch: corrects typo
      in cpan/CPAN/lib/CPAN/Distribution.pm.
    - CVE-2020-16156

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Tue, 04 Oct 2022 15:16:23 -0300

perl (5.34.0-3ubuntu1) jammy; urgency=medium

  * Merge with Debian; remaining changes:
    - Disable two porting/libperl.t tests, only run on x86*, and only
      testing the static libperl.a.
    - Disable the same porting/libperl.t tests on x86*, as on the other
      Linux architectures.

 -- Matthias Klose <doko@ubuntu.com>  Sun, 06 Feb 2022 12:02:58 +0100

perl (5.34.0-3) unstable; urgency=medium

  * Add 5.34.0 to debian/released-versions.
  * Upload to unstable.

 -- Niko Tyni <ntyni@debian.org>  Sat, 05 Feb 2022 12:20:54 +0200

perl (5.34.0-2) experimental; urgency=medium

  * Apply upstream patch fixing issues with gdbm 1.20. (Closes: #993514)

 -- Niko Tyni <ntyni@debian.org>  Fri, 27 Aug 2021 22:02:26 +0300

# For older changelog entries, run 'apt-get changelog libperl5.34'
