-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 30 Aug 2026 11:53:55 +0300
Source: perl
Binary: libperl-dev libperl5.40 perl perl-base perl-debug
Architecture: armhf
Version: 5.40.1-6+deb13u1
Distribution: trixie
Urgency: medium
Maintainer: armhf Build Daemon (arm-conova-04) <buildd_arm64-arm-conova-04@buildd.debian.org>
Changed-By: Niko Tyni <ntyni@debian.org>
Description:
 libperl-dev - Perl library: development files
 libperl5.40 - shared Perl library
 perl       - Larry Wall's Practical Extraction and Report Language
 perl-base  - minimal Perl system
 perl-debug - debug-enabled Perl interpreter
Closes: 1137345 1138854 1138855 1138856 1138858 1138859 1138860 1138863 1138905 1138906 1140152 1141639 1142037
Changes:
 perl (5.40.1-6+deb13u1) trixie; urgency=medium
 .
   * [SECURITY] various upstream fixes:
     + CVE-2026-7017: HTTP::Tiny credential forwarding on redirects.
         (Closes: #1141639)
     + CVE-2026-42496: Archive::Tar symlink extraction.
         (Closes: #1138860)
     + CVE-2026-42497: Archive::Tar hardlink extraction.
         (Closes: #1138859)
     + CVE-2026-12087: Socket: pack_ip_mreq_source() out-of-bounds heap read.
         (Closes: #1140152)
     + CVE-2026-13221: silently incorrect regular expression matches.
         (Closes: #1142037)
     + CVE-2025-15649: header parsing in IO::Uncompress::Unzip.
         (Closes: #1138863)
     + CVE-2026-7010:  CRLF-validation in HTTP::Tiny.
         (Closes: #1138858)
     + CVE-2026-8376:  Buffer overflow in Perl_study_chunk.
         (Closes: #1137345)
     + CVE-2026-48959: CPU exhaustion in IO::Uncompress::Unzip.
         (Closes: #1138856)
     + CVE-2026-48961: crash in zipdetails.
         (Closes: #1138855)
     + CVE-2026-48962: code execution in IO-Compress via output globs.
         (Closes: #1138854)
     + CVE-2026-57432: out of bound heap reads in pack() and unpack().
          (Closes: #1138905)
     + CVE-2026-57433: signed integer overflow in Storable.
          (Closes: #1138906)
Checksums-Sha1:
 60d1db0a0d7a5c36fc6dc4f782bc6812d537002b 997968 libperl-dev_5.40.1-6+deb13u1_armhf.deb
 fee209fc41506fdec641fd3dc2fe0a3b6b0c2070 3627760 libperl5.40_5.40.1-6+deb13u1_armhf.deb
 6abd8a7d54f90483dd77973dbbc32c894af9c8d1 1515944 perl-base_5.40.1-6+deb13u1_armhf.deb
 851515fa792c54711c5bf2cb36cc69aaf38127dc 12795868 perl-debug_5.40.1-6+deb13u1_armhf.deb
 08b3701bb5ee45578a4317a7d862cd2b7399225c 7027 perl_5.40.1-6+deb13u1_armhf-buildd.buildinfo
 854564cba5e4b1c33a0dd0b8d2f803fb44377efc 267732 perl_5.40.1-6+deb13u1_armhf.deb
Checksums-Sha256:
 92a0567fd181ef3af8d2cc2207a6d4ea4c9659f3d96806f5302ebfc4a09e487d 997968 libperl-dev_5.40.1-6+deb13u1_armhf.deb
 a0ea2a376e5195ebfb5604ace234e9e427840156847de6086d0f1cd112246a66 3627760 libperl5.40_5.40.1-6+deb13u1_armhf.deb
 0086a1585ff135c4caa57ae03e1195e9d861b7d8a88c69db4498f1f945aa2f39 1515944 perl-base_5.40.1-6+deb13u1_armhf.deb
 61e2b018770201819f938102db66b02f63d03bb4f6bde7352c91cb7949a86dab 12795868 perl-debug_5.40.1-6+deb13u1_armhf.deb
 243b4e4cd194ad4cd5e11b732e285b814f258856dcf33afc27663297e83c2d64 7027 perl_5.40.1-6+deb13u1_armhf-buildd.buildinfo
 bb9d3b975a2dbf09da7b5ec96717271137d238cd0362a246a773c6fa25655c73 267732 perl_5.40.1-6+deb13u1_armhf.deb
Files:
 e1242f4f25b52eff7765a9966845fe57 997968 libdevel optional libperl-dev_5.40.1-6+deb13u1_armhf.deb
 c75b25d870f0e94c30161f3f60379db7 3627760 libs optional libperl5.40_5.40.1-6+deb13u1_armhf.deb
 c2a709bb6cf8fd0654e68450dce0ea78 1515944 perl required perl-base_5.40.1-6+deb13u1_armhf.deb
 ad017b145f3f457d1fcb2d3b318e7cf4 12795868 devel optional perl-debug_5.40.1-6+deb13u1_armhf.deb
 5f8d92766c1a78afe4e212ef02ebfd2b 7027 perl standard perl_5.40.1-6+deb13u1_armhf-buildd.buildinfo
 ead7db623f6c46a95d26bd9ead08371e 267732 perl standard perl_5.40.1-6+deb13u1_armhf.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEgSZRd/+N1Ed3hy+mPMAxAOQQpzsFAmqYpCQACgkQPMAxAOQQ
pzsOGw//TzSgr3df3g5WdgWIuZES+SgYAkX6iaOdztrqt95PU4/Uy90kw09w3FbG
kXQ6IKAW69qi5KKPm7ZRLu6Uomh/7XsSWnnpWFzvql3Bu8HlIEfOsYdsZlSQQVbA
DzpKH6S4/t/IfGMHTMS/84CaxiZilZ8/FWxcQPslnRJzPqgL6GYExQ97mPUH3PaT
a60uzzdBJnAYDDmaHoxARRYAzhc0i8GQTgTfekGWfin8F8WsrVFIoNfwhd30sJfV
1iFpPJ+txopyPPTXpT5mSUGiAIfjfo5A7a7Cj85lrTkW1naOkRkFE9GEi9f2P+i7
ZNhLpy7E+aHAMkf0a5bv+Ceiv5tLBCdhad6fiVMGblzZcnj3Swnav4D8TPc/D5gQ
+KWRwMulFbdQWMypfy0RxgKuwSzeokeAK6l3Y6jKcaVu7aqhQk70OUy2lsZQ1Y+a
OGPG+LH9Za7aLBhfENRSFfl2bJBz6ONRVzQA033a/nrR/fNP6zNTcSKbTcT6BYbb
xT8c7/2/dROGQSdkgGOB4uc9MtRhkqHXH+12n82015Goyv2JU+LNGnpc6xRJM0ph
3t7X9h49VXvanDb4ri9Tby3Z7aH7maghGQpoDky8lNrgx7AzoQbJfbX2CYCP5nJL
brZOYtvEvu+R80oEwj/XvALw4K41ngdgwEIKB7wjdrwOP6eI9A4=
=iD98
-----END PGP SIGNATURE-----