Wed Jun 3 08:39:16 2020 UTC ()
perl5: updated to 5.30.3

perl v5.30.3

Security
   [CVE-2020-10543] Buffer overflow caused by a crafted regular expression
       A signed "size_t" integer overflow in the storage space calculations for nested regular expression
       quantifiers could cause a heap buffer overflow in Perl's regular expression compiler that overwrites memory
       allocated after the regular expression storage space with attacker supplied data.

       The target system needs a sufficient amount of memory to allocate partial expansions of the nested
       quantifiers prior to the overflow occurring.  This requirement is unlikely to be met on 64-bit systems.

   [CVE-2020-10878] Integer overflow via malformed bytecode produced by a crafted regular expression
       Integer overflows in the calculation of offsets between instructions for the regular expression engine could
       cause corruption of the intermediate language state of a compiled regular expression.  An attacker could
       abuse this behaviour to insert instructions into the compiled form of a Perl regular expression.

   [CVE-2020-12723] Buffer overflow caused by a crafted regular expression
       Recursive calls to "S_study_chunk()" by Perl's regular expression compiler to optimize the intermediate
       language representation of a regular expression could cause corruption of the intermediate language state of
       a compiled regular expression.

   Additional Note
       An application written in Perl would only be vulnerable to any of the above flaws if it evaluates regular
       expressions supplied by the attacker.  Evaluating regular expressions in this fashion is known to be
       dangerous since the regular expression engine does not protect against denial of service attacks in this
       usage scenario.

Incompatible Changes
       There are no changes intentionally incompatible with Perl 5.30.2.

Modules and Pragmata
   Updated Modules and Pragmata
       o   Module::CoreList has been upgraded from version 5.20200314 to 5.20200601_30.


(adam)
diff -r1.39 -r1.40 pkgsrc/lang/perl5/Makefile.common
diff -r1.162 -r1.163 pkgsrc/lang/perl5/distinfo

cvs diff -r1.39 -r1.40 pkgsrc/lang/perl5/Makefile.common (expand / switch to unified diff)

--- pkgsrc/lang/perl5/Makefile.common 2020/03/15 20:10:46 1.39
+++ pkgsrc/lang/perl5/Makefile.common 2020/06/03 08:39:16 1.40
@@ -1,14 +1,14 @@ @@ -1,14 +1,14 @@
1# $NetBSD: Makefile.common,v 1.39 2020/03/15 20:10:46 wiz Exp $ 1# $NetBSD: Makefile.common,v 1.40 2020/06/03 08:39:16 adam Exp $
2# 2#
3# used by lang/perl5/Makefile 3# used by lang/perl5/Makefile
4# used by databases/p5-gdbm/Makefile 4# used by databases/p5-gdbm/Makefile
5 5
6DISTNAME= perl-5.30.2 6DISTNAME= perl-5.30.3
7CATEGORIES= lang devel perl5 7CATEGORIES= lang devel perl5
8MASTER_SITES= ${MASTER_SITE_PERL_CPAN:S,/modules/by-module/$,/src/5.0/,} 8MASTER_SITES= ${MASTER_SITE_PERL_CPAN:S,/modules/by-module/$,/src/5.0/,}
9DISTFILES+= ${DISTNAME}${EXTRACT_SUFX} 9DISTFILES+= ${DISTNAME}${EXTRACT_SUFX}
10EXTRACT_SUFX= .tar.xz 10EXTRACT_SUFX= .tar.xz
11 11
12MAINTAINER= pkgsrc-users@NetBSD.org 12MAINTAINER= pkgsrc-users@NetBSD.org
13HOMEPAGE= https://www.perl.org/ 13HOMEPAGE= https://www.perl.org/
14LICENSE= ${PERL5_LICENSE} 14LICENSE= ${PERL5_LICENSE}

cvs diff -r1.162 -r1.163 pkgsrc/lang/perl5/distinfo (expand / switch to unified diff)

--- pkgsrc/lang/perl5/distinfo 2020/03/15 20:10:46 1.162
+++ pkgsrc/lang/perl5/distinfo 2020/06/03 08:39:16 1.163
@@ -1,19 +1,19 @@ @@ -1,19 +1,19 @@
1$NetBSD: distinfo,v 1.162 2020/03/15 20:10:46 wiz Exp $ 1$NetBSD: distinfo,v 1.163 2020/06/03 08:39:16 adam Exp $
2 2
3SHA1 (perl-5.30.2.tar.xz) = d82cdaa610a3e749e821fc77004b1b4bfd5ebd28 3SHA1 (perl-5.30.3.tar.xz) = 1003c6aa71d8966501038178459a9fa4e9aba747
4RMD160 (perl-5.30.2.tar.xz) = 3396f046beb7cab923cab37fa80fdcb40af5139d 4RMD160 (perl-5.30.3.tar.xz) = 7aaec213f6537a53abd8fd97bb96d91b681cdf1e
5SHA512 (perl-5.30.2.tar.xz) = b945c95f44a58b9cc920c926e23017c4270c0dc8daf0bf8169cd7c8f6b8f980f1780bee4fbd525df518edc50f08364ba65988cb17e72a1667f50226459b65087 5SHA512 (perl-5.30.3.tar.xz) = 0ea62cf17532ee99217a218c39aa530472857c7a1982494f3a01693683062b4cdebe383a79f7b64452c713337b554ed5e0fd6eda018ea29e83c3538a13c24f3c
6Size (perl-5.30.2.tar.xz) = 12373480 bytes 6Size (perl-5.30.3.tar.xz) = 12375128 bytes
7SHA1 (patch-Configure) = 6000aafeb993fd096c9b1327302b510aa0d386bb 7SHA1 (patch-Configure) = 6000aafeb993fd096c9b1327302b510aa0d386bb
8SHA1 (patch-Makefile.SH) = 56203aea57c429a94760f039a978463b8859b0a9 8SHA1 (patch-Makefile.SH) = 56203aea57c429a94760f039a978463b8859b0a9
9SHA1 (patch-Safe.pm) = bfeefb82d4cfe991e3a9a90cd87b894c9f4cc337 9SHA1 (patch-Safe.pm) = bfeefb82d4cfe991e3a9a90cd87b894c9f4cc337
10SHA1 (patch-alignment_1) = b68c0916b271523922caa7f89edb165284e7b5f4 10SHA1 (patch-alignment_1) = b68c0916b271523922caa7f89edb165284e7b5f4
11SHA1 (patch-alignment_2) = cae8495c4a092e31da422bf5684481091ee2adf3 11SHA1 (patch-alignment_2) = cae8495c4a092e31da422bf5684481091ee2adf3
12SHA1 (patch-caretx.c) = b76b4175a58123fa4dfd2adf36b2207dcb6cf65a 12SHA1 (patch-caretx.c) = b76b4175a58123fa4dfd2adf36b2207dcb6cf65a
13SHA1 (patch-cflags.SH) = 7ad64e5a17b876bff4bbe238abc4a57354acf4fe 13SHA1 (patch-cflags.SH) = 7ad64e5a17b876bff4bbe238abc4a57354acf4fe
14SHA1 (patch-cpan_ExtUtils-MakeMaker_lib_ExtUtils_MM__Unix.pm) = 3a2b39c9eb903e68ef7d03ae448c51c147c19aa1 14SHA1 (patch-cpan_ExtUtils-MakeMaker_lib_ExtUtils_MM__Unix.pm) = 3a2b39c9eb903e68ef7d03ae448c51c147c19aa1
15SHA1 (patch-hints_cygwin.sh) = 1b21d927d6b7379754c4cd64a2b05d3632c35470 15SHA1 (patch-hints_cygwin.sh) = 1b21d927d6b7379754c4cd64a2b05d3632c35470
16SHA1 (patch-hints_linux.sh) = 4baa8f80695687abb53d4f4e1830cf86db5b2bf7 16SHA1 (patch-hints_linux.sh) = 4baa8f80695687abb53d4f4e1830cf86db5b2bf7
17SHA1 (patch-hints_minix.sh) = cb62ad0be5c38ca5b79f180252ca0843a0444f8a 17SHA1 (patch-hints_minix.sh) = cb62ad0be5c38ca5b79f180252ca0843a0444f8a
18SHA1 (patch-hints_netbsd.sh) = 0d549a48800372d75fe34b783529a78cba90f646 18SHA1 (patch-hints_netbsd.sh) = 0d549a48800372d75fe34b783529a78cba90f646
19SHA1 (patch-hints_solaris__2.sh) = 0e54889648a6f0f2a0232c5e01bef89d245c213d 19SHA1 (patch-hints_solaris__2.sh) = 0e54889648a6f0f2a0232c5e01bef89d245c213d