perl-devel January 2013

perl-devel@lists.fedoraproject.org

24 participants
789 discussions

[Bug 786080] New: perl-Shipwright-2.4.31 is available
by Red Hat Bugzilla 11 Jan '13

11 Jan '13

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug. Summary: perl-Shipwright-2.4.31 is available https://bugzilla.redhat.com/show_bug.cgi?id=786080 Summary: perl-Shipwright-2.4.31 is available Product: Fedora Version: rawhide Platform: Unspecified OS/Version: Unspecified Status: NEW Keywords: FutureFeature, Triaged Severity: unspecified Priority: unspecified Component: perl-Shipwright AssignedTo: robinlee.sysu(a)gmail.com ReportedBy: upstream-release-monitoring(a)fedoraproject.org QAContact: extras-qa(a)fedoraproject.org CC: fedora-perl-devel-list(a)redhat.com, robinlee.sysu(a)gmail.com Classification: Fedora Story Points: --- Type: --- Regression: --- Mount Type: --- Documentation: --- Latest upstream release: 2.4.31 Current version in Fedora Rawhide: 2.4.30 URL: http://search.cpan.org/dist/Shipwright/ Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring -- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 7

[perl-MIME-Types] Created tag perl-MIME-Types-1.38-1.fc19
by Paul Howarth 11 Jan '13

11 Jan '13

The lightweight tag 'perl-MIME-Types-1.38-1.fc19' was created pointing to: 8c99be4... Update to 1.38

1 0

[perl-MIME-Types] Update to 1.38
by Paul Howarth 11 Jan '13

11 Jan '13

commit 8c99be467b5ef06e73ede4fb793e0f6ac3b8090e Author: Paul Howarth <paul(a)city-fan.org> Date: Fri Jan 11 13:46:06 2013 +0000 Update to 1.38 - New upstream release 1.38: - Add application/vnd.ms-excel.template.macroEnabled.12 and five related from http://filext.com/faq/office_mime_types.php (CPAN RT#82616) perl-MIME-Types.spec | 7 ++++++- sources | 2 +- 2 files changed, 7 insertions(+), 2 deletions(-) --- diff --git a/perl-MIME-Types.spec b/perl-MIME-Types.spec index d1e8a68..ad60689 100644 --- a/perl-MIME-Types.spec +++ b/perl-MIME-Types.spec @@ -1,5 +1,5 @@ Name: perl-MIME-Types -Version: 1.37 +Version: 1.38 Release: 1%{?dist} Summary: MIME types module for Perl License: GPL+ or Artistic @@ -55,6 +55,11 @@ rm -rf %{buildroot} %{_mandir}/man3/MIME::Types.3pm* %changelog +* Fri Jan 11 2013 Paul Howarth <paul(a)city-fan.org> - 1.38-1 +- Update to 1.38: + - Add application/vnd.ms-excel.template.macroEnabled.12 and five related + from http://filext.com/faq/office_mime_types.php (CPAN RT#82616) + * Fri Dec 21 2012 Paul Howarth <paul(a)city-fan.org> - 1.37-1 - Update to 1.37: - Remove text/x-perl, where we also have an application/x-perl diff --git a/sources b/sources index f6a3131..722276b 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -d491cc7a7ba77c0d6e930ff9cfbdea61 MIME-Types-1.37.tar.gz +994baebea02be46123cc888da5b32b8d MIME-Types-1.38.tar.gz

1 0

File MIME-Types-1.38.tar.gz uploaded to lookaside cache by pghmcfc
by Paul Howarth 11 Jan '13

11 Jan '13

A file has been added to the lookaside cache for perl-MIME-Types: 994baebea02be46123cc888da5b32b8d MIME-Types-1.38.tar.gz

1 0

[perl/f16] Fix CVE-2012-6329
by Petr Pisar 11 Jan '13

11 Jan '13

commit 900478ee676e4edd4225f1a569707385586dc8f3 Author: Petr Písař <ppisar(a)redhat.com> Date: Fri Jan 11 13:42:11 2013 +0100 Fix CVE-2012-6329 ...5.17.6-Fix-misparsing-of-maketext-strings.patch | 81 ++++++++++++++++++++ perl.spec | 10 ++- 2 files changed, 90 insertions(+), 1 deletions(-) --- diff --git a/perl-5.17.6-Fix-misparsing-of-maketext-strings.patch b/perl-5.17.6-Fix-misparsing-of-maketext-strings.patch new file mode 100644 index 0000000..9a8629f --- /dev/null +++ b/perl-5.17.6-Fix-misparsing-of-maketext-strings.patch @@ -0,0 +1,81 @@ +From 1735f6f53ca19f99c6e9e39496c486af323ba6a8 Mon Sep 17 00:00:00 2001 +From: Brian Carlson <brian.carlson(a)cpanel.net> +Date: Wed, 28 Nov 2012 08:54:33 -0500 +Subject: [PATCH] Fix misparsing of maketext strings. + +Case 61251: This commit fixes a misparse of maketext strings that could +lead to arbitrary code execution. Basically, maketext was compiling +bracket notation into functions, but neglected to escape backslashes +inside the content or die on fully-qualified method names when +generating the code. This change escapes all such backslashes and dies +when a method name with a colon or apostrophe is specified. +--- + AUTHORS | 1 + + dist/Locale-Maketext/lib/Locale/Maketext.pm | 24 ++++++++---------------- + 2 files changed, 9 insertions(+), 16 deletions(-) + +diff --git a/AUTHORS b/AUTHORS +index 70734b0..009dea0 100644 +--- a/AUTHORS ++++ b/AUTHORS +@@ -154,6 +154,7 @@ Breno G. de Oliveira <garu(a)cpan.org> + Brent Dax <brentdax(a)cpan.org> + Brooks D Boyd + Brian Callaghan <callagh(a)itginc.com> ++Brian Carlson <brian.carlson(a)cpanel.net> + Brian Clarke <clarke(a)appliedmeta.com> + brian d foy <brian.d.foy(a)gmail.com> + Brian Fraser <fraserbn(a)gmail.com> +diff --git a/dist/Locale-Maketext/lib/Locale/Maketext.pm b/dist/Locale-Maketext/lib/Locale/Maketext.pm +index 4822027..63e5fba 100644 +--- a/dist/Locale-Maketext/lib/Locale/Maketext.pm ++++ b/dist/Locale-Maketext/lib/Locale/Maketext.pm +@@ -625,21 +625,9 @@ sub _compile { + # 0-length method name means to just interpolate: + push @code, ' ('; + } +- elsif($m =~ /^\w+(?:\:\:\w+)*$/s +- and $m !~ m/(?:^|\:)\d/s +- # exclude starting a (sub)package or symbol with a digit ++ elsif($m =~ /^\w+$/s ++ # exclude anything fancy, especially fully-qualified module names + ) { +- # Yes, it even supports the demented (and undocumented?) +- # $obj->Foo::bar(...) syntax. +- $target->_die_pointing( +- $string_to_compile, q{Can't use "SUPER::" in a bracket-group method}, +- 2 + length($c[-1]) +- ) +- if $m =~ m/^SUPER::/s; +- # Because for SUPER:: to work, we'd have to compile this into +- # the right package, and that seems just not worth the bother, +- # unless someone convinces me otherwise. +- + push @code, ' $_[0]->' . $m . '('; + } + else { +@@ -693,7 +681,9 @@ sub _compile { + elsif(substr($1,0,1) ne '~') { + # it's stuff not containing "~" or "[" or "]" + # i.e., a literal blob +- $c[-1] .= $1; ++ my $text = $1; ++ $text =~ s/\\/\\\\/g; ++ $c[-1] .= $text; + + } + elsif($1 eq '~~') { # "~~" +@@ -731,7 +721,9 @@ sub _compile { + else { + # It's a "~X" where X is not a special character. + # Consider it a literal ~ and X. +- $c[-1] .= $1; ++ my $text = $1; ++ $text =~ s/\\/\\\\/g; ++ $c[-1] .= $text; + } + } + } +-- +1.7.11.7 + diff --git a/perl.spec b/perl.spec index a4d6ebb..b142c60 100644 --- a/perl.spec +++ b/perl.spec @@ -25,7 +25,7 @@ Name: perl Version: %{perl_version} # release number must be even higher, because dual-lived modules will be broken otherwise -Release: 204%{?dist} +Release: 205%{?dist} Epoch: %{perl_epoch} Summary: Practical Extraction and Report Language Group: Development/Languages @@ -109,6 +109,9 @@ Patch20: perl-5.14.2-perl-100340-Free-hash-entries-before-values-on-delet # podlators-2.4.1 Patch21: perl-5.14.2-Override-the-Pod-Simple-parse_file.patch +# Fix CVE-2012-6329, rhbz#884354 +Patch22: perl-5.17.6-Fix-misparsing-of-maketext-strings.patch + # Update some of the bundled modules # see http://fedoraproject.org/wiki/Perl/perl.spec for instructions @@ -1163,6 +1166,7 @@ tarball from perl.org. %patch18 -p1 %patch20 -p1 %patch21 -p1 +%patch22 -p1 #copy the example script cp -a %{SOURCE5} . @@ -1363,6 +1367,7 @@ pushd %{build_archlib}/CORE/ 'Fedora Patch18: Do not truncate syscall() return value to 32 bits (RT#113980)' \ 'Fedora Patch20: Free hash entries before values on delete (RT#100340)' \ 'Fedora Patch21: Override the Pod::Simple::parse_file (CPANRT#77530)' \ + 'Fedora Patch22: Fix misparsing of maketext strings (CVE-2012-6329)' \ %{nil} rm patchlevel.bak @@ -2254,6 +2259,9 @@ sed \ # Old changelog entries are preserved in CVS. %changelog +* Fri Jan 11 2013 Petr Pisar <ppisar(a)redhat.com> - 4:5.14.3-205 +- Fix CVE-2012-6329 (misparsing of maketext strings) (bug #884354) + * Thu Jan 10 2013 Petr Pisar <ppisar(a)redhat.com> - 4:5.14.3-204 - Do not package App::Cpan(3pm) to perl-Test-Harness (bug #893768)

1 0

[perl/f17] Fix CVE-2012-6329
by Petr Pisar 11 Jan '13

11 Jan '13

commit 07cc42ddefaa295b1a194d6a20d47f7da554eb73 Author: Petr Písař <ppisar(a)redhat.com> Date: Fri Jan 11 13:42:11 2013 +0100 Fix CVE-2012-6329 ...5.17.6-Fix-misparsing-of-maketext-strings.patch | 81 ++++++++++++++++++++ perl.spec | 10 ++- 2 files changed, 90 insertions(+), 1 deletions(-) --- diff --git a/perl-5.17.6-Fix-misparsing-of-maketext-strings.patch b/perl-5.17.6-Fix-misparsing-of-maketext-strings.patch new file mode 100644 index 0000000..9a8629f --- /dev/null +++ b/perl-5.17.6-Fix-misparsing-of-maketext-strings.patch @@ -0,0 +1,81 @@ +From 1735f6f53ca19f99c6e9e39496c486af323ba6a8 Mon Sep 17 00:00:00 2001 +From: Brian Carlson <brian.carlson(a)cpanel.net> +Date: Wed, 28 Nov 2012 08:54:33 -0500 +Subject: [PATCH] Fix misparsing of maketext strings. + +Case 61251: This commit fixes a misparse of maketext strings that could +lead to arbitrary code execution. Basically, maketext was compiling +bracket notation into functions, but neglected to escape backslashes +inside the content or die on fully-qualified method names when +generating the code. This change escapes all such backslashes and dies +when a method name with a colon or apostrophe is specified. +--- + AUTHORS | 1 + + dist/Locale-Maketext/lib/Locale/Maketext.pm | 24 ++++++++---------------- + 2 files changed, 9 insertions(+), 16 deletions(-) + +diff --git a/AUTHORS b/AUTHORS +index 70734b0..009dea0 100644 +--- a/AUTHORS ++++ b/AUTHORS +@@ -154,6 +154,7 @@ Breno G. de Oliveira <garu(a)cpan.org> + Brent Dax <brentdax(a)cpan.org> + Brooks D Boyd + Brian Callaghan <callagh(a)itginc.com> ++Brian Carlson <brian.carlson(a)cpanel.net> + Brian Clarke <clarke(a)appliedmeta.com> + brian d foy <brian.d.foy(a)gmail.com> + Brian Fraser <fraserbn(a)gmail.com> +diff --git a/dist/Locale-Maketext/lib/Locale/Maketext.pm b/dist/Locale-Maketext/lib/Locale/Maketext.pm +index 4822027..63e5fba 100644 +--- a/dist/Locale-Maketext/lib/Locale/Maketext.pm ++++ b/dist/Locale-Maketext/lib/Locale/Maketext.pm +@@ -625,21 +625,9 @@ sub _compile { + # 0-length method name means to just interpolate: + push @code, ' ('; + } +- elsif($m =~ /^\w+(?:\:\:\w+)*$/s +- and $m !~ m/(?:^|\:)\d/s +- # exclude starting a (sub)package or symbol with a digit ++ elsif($m =~ /^\w+$/s ++ # exclude anything fancy, especially fully-qualified module names + ) { +- # Yes, it even supports the demented (and undocumented?) +- # $obj->Foo::bar(...) syntax. +- $target->_die_pointing( +- $string_to_compile, q{Can't use "SUPER::" in a bracket-group method}, +- 2 + length($c[-1]) +- ) +- if $m =~ m/^SUPER::/s; +- # Because for SUPER:: to work, we'd have to compile this into +- # the right package, and that seems just not worth the bother, +- # unless someone convinces me otherwise. +- + push @code, ' $_[0]->' . $m . '('; + } + else { +@@ -693,7 +681,9 @@ sub _compile { + elsif(substr($1,0,1) ne '~') { + # it's stuff not containing "~" or "[" or "]" + # i.e., a literal blob +- $c[-1] .= $1; ++ my $text = $1; ++ $text =~ s/\\/\\\\/g; ++ $c[-1] .= $text; + + } + elsif($1 eq '~~') { # "~~" +@@ -731,7 +721,9 @@ sub _compile { + else { + # It's a "~X" where X is not a special character. + # Consider it a literal ~ and X. +- $c[-1] .= $1; ++ my $text = $1; ++ $text =~ s/\\/\\\\/g; ++ $c[-1] .= $text; + } + } + } +-- +1.7.11.7 + diff --git a/perl.spec b/perl.spec index be0a97e..fa04952 100644 --- a/perl.spec +++ b/perl.spec @@ -27,7 +27,7 @@ Name: perl Version: %{perl_version} # release number must be even higher, because dual-lived modules will be broken otherwise -Release: 219%{?dist} +Release: 220%{?dist} Epoch: %{perl_epoch} Summary: Practical Extraction and Report Language Group: Development/Languages @@ -114,6 +114,9 @@ Patch20: perl-5.14.2-perl-100340-Free-hash-entries-before-values-on-delet # podlators-2.4.1 Patch21: perl-5.14.2-Override-the-Pod-Simple-parse_file.patch +# Fix CVE-2012-6329, rhbz#884354 +Patch22: perl-5.17.6-Fix-misparsing-of-maketext-strings.patch + # Update some of the bundled modules # see http://fedoraproject.org/wiki/Perl/perl.spec for instructions @@ -1288,6 +1291,7 @@ tarball from perl.org. %patch19 -p1 %patch20 -p1 %patch21 -p1 +%patch22 -p1 #copy the example script cp -a %{SOURCE5} . @@ -1498,6 +1502,7 @@ pushd %{build_archlib}/CORE/ 'Fedora Patch19: Do not crash when vivifying $|' \ 'Fedora Patch20: Free hash entries before values on delete (RT#100340)' \ 'Fedora Patch21: Override the Pod::Simple::parse_file (CPANRT#77530)' \ + 'Fedora Patch22: Fix misparsing of maketext strings (CVE-2012-6329)' \ %{nil} rm patchlevel.bak @@ -2451,6 +2456,9 @@ sed \ # Old changelog entries are preserved in CVS. %changelog +* Fri Jan 11 2013 Petr Pisar <ppisar(a)redhat.com> - 4:5.14.3-220 +- Fix CVE-2012-6329 (misparsing of maketext strings) (bug #884354) + * Thu Jan 10 2013 Petr Pisar <ppisar(a)redhat.com> - 4:5.14.3-219 - Do not package App::Cpan(3pm) to perl-Test-Harness (bug #893768)

1 0

[perl/f18] Fix CVE-2012-6329
by Petr Pisar 11 Jan '13

11 Jan '13

commit 6b14b9a82d9cf796ce290dbc29078f5471cb4147 Author: Petr Písař <ppisar(a)redhat.com> Date: Fri Jan 11 13:42:11 2013 +0100 Fix CVE-2012-6329 ...5.17.6-Fix-misparsing-of-maketext-strings.patch | 81 ++++++++++++++++++++ perl.spec | 10 ++- 2 files changed, 90 insertions(+), 1 deletions(-) --- diff --git a/perl-5.17.6-Fix-misparsing-of-maketext-strings.patch b/perl-5.17.6-Fix-misparsing-of-maketext-strings.patch new file mode 100644 index 0000000..9a8629f --- /dev/null +++ b/perl-5.17.6-Fix-misparsing-of-maketext-strings.patch @@ -0,0 +1,81 @@ +From 1735f6f53ca19f99c6e9e39496c486af323ba6a8 Mon Sep 17 00:00:00 2001 +From: Brian Carlson <brian.carlson(a)cpanel.net> +Date: Wed, 28 Nov 2012 08:54:33 -0500 +Subject: [PATCH] Fix misparsing of maketext strings. + +Case 61251: This commit fixes a misparse of maketext strings that could +lead to arbitrary code execution. Basically, maketext was compiling +bracket notation into functions, but neglected to escape backslashes +inside the content or die on fully-qualified method names when +generating the code. This change escapes all such backslashes and dies +when a method name with a colon or apostrophe is specified. +--- + AUTHORS | 1 + + dist/Locale-Maketext/lib/Locale/Maketext.pm | 24 ++++++++---------------- + 2 files changed, 9 insertions(+), 16 deletions(-) + +diff --git a/AUTHORS b/AUTHORS +index 70734b0..009dea0 100644 +--- a/AUTHORS ++++ b/AUTHORS +@@ -154,6 +154,7 @@ Breno G. de Oliveira <garu(a)cpan.org> + Brent Dax <brentdax(a)cpan.org> + Brooks D Boyd + Brian Callaghan <callagh(a)itginc.com> ++Brian Carlson <brian.carlson(a)cpanel.net> + Brian Clarke <clarke(a)appliedmeta.com> + brian d foy <brian.d.foy(a)gmail.com> + Brian Fraser <fraserbn(a)gmail.com> +diff --git a/dist/Locale-Maketext/lib/Locale/Maketext.pm b/dist/Locale-Maketext/lib/Locale/Maketext.pm +index 4822027..63e5fba 100644 +--- a/dist/Locale-Maketext/lib/Locale/Maketext.pm ++++ b/dist/Locale-Maketext/lib/Locale/Maketext.pm +@@ -625,21 +625,9 @@ sub _compile { + # 0-length method name means to just interpolate: + push @code, ' ('; + } +- elsif($m =~ /^\w+(?:\:\:\w+)*$/s +- and $m !~ m/(?:^|\:)\d/s +- # exclude starting a (sub)package or symbol with a digit ++ elsif($m =~ /^\w+$/s ++ # exclude anything fancy, especially fully-qualified module names + ) { +- # Yes, it even supports the demented (and undocumented?) +- # $obj->Foo::bar(...) syntax. +- $target->_die_pointing( +- $string_to_compile, q{Can't use "SUPER::" in a bracket-group method}, +- 2 + length($c[-1]) +- ) +- if $m =~ m/^SUPER::/s; +- # Because for SUPER:: to work, we'd have to compile this into +- # the right package, and that seems just not worth the bother, +- # unless someone convinces me otherwise. +- + push @code, ' $_[0]->' . $m . '('; + } + else { +@@ -693,7 +681,9 @@ sub _compile { + elsif(substr($1,0,1) ne '~') { + # it's stuff not containing "~" or "[" or "]" + # i.e., a literal blob +- $c[-1] .= $1; ++ my $text = $1; ++ $text =~ s/\\/\\\\/g; ++ $c[-1] .= $text; + + } + elsif($1 eq '~~') { # "~~" +@@ -731,7 +721,9 @@ sub _compile { + else { + # It's a "~X" where X is not a special character. + # Consider it a literal ~ and X. +- $c[-1] .= $1; ++ my $text = $1; ++ $text =~ s/\\/\\\\/g; ++ $c[-1] .= $text; + } + } + } +-- +1.7.11.7 + diff --git a/perl.spec b/perl.spec index f20973a..42e79e9 100644 --- a/perl.spec +++ b/perl.spec @@ -29,7 +29,7 @@ Name: perl Version: %{perl_version} # release number must be even higher, because dual-lived modules will be broken otherwise -Release: 236%{?dist} +Release: 237%{?dist} Epoch: %{perl_epoch} Summary: Practical Extraction and Report Language Group: Development/Languages @@ -109,6 +109,9 @@ Patch18: perl-5.16.1-perl-114984-Glob.xs-Extend-stack-when-returning.patc # Do not crash when vivifying $|, rhbz#865296, RT#115206 Patch19: perl-5.16.1-perl-115206-Don-t-crash-when-vivifying.patch +# Fix CVE-2012-6329, rhbz#884354 +Patch20: perl-5.17.6-Fix-misparsing-of-maketext-strings.patch + # Update some of the bundled modules # see http://fedoraproject.org/wiki/Perl/perl.spec for instructions @@ -1336,6 +1339,7 @@ tarball from perl.org. %patch17 -p1 %patch18 -p1 %patch19 -p1 +%patch20 -p1 #copy the example script cp -a %{SOURCE5} . @@ -1546,6 +1550,7 @@ pushd %{build_archlib}/CORE/ 'Fedora Patch17: Allow operator after numeric keyword argument (RT#105924)' \ 'Fedora Patch18: Extend stack in File::Glob::glob, (RT#114984)' \ 'Fedora Patch19: Do not crash when vivifying $|' \ + 'Fedora Patch20: Fix misparsing of maketext strings (CVE-2012-6329)' \ %{nil} rm patchlevel.bak @@ -2618,6 +2623,9 @@ sed \ # Old changelog entries are preserved in CVS. %changelog +* Fri Jan 11 2013 Petr Pisar <ppisar(a)redhat.com> - 4:5.16.2-237 +- Fix CVE-2012-6329 (misparsing of maketext strings) (bug #884354) + * Thu Jan 10 2013 Petr Pisar <ppisar(a)redhat.com> - 4:5.16.2-236 - Do not package App::Cpan(3pm) to perl-Test-Harness (bug #893768)

1 0

[perl] Fix CVE-2012-6329
by Petr Pisar 11 Jan '13

11 Jan '13

commit add42744d75d737dcb493ba01b05683774174465 Author: Petr Písař <ppisar(a)redhat.com> Date: Fri Jan 11 13:42:11 2013 +0100 Fix CVE-2012-6329 ...5.17.6-Fix-misparsing-of-maketext-strings.patch | 81 ++++++++++++++++++++ perl.spec | 10 ++- 2 files changed, 90 insertions(+), 1 deletions(-) --- diff --git a/perl-5.17.6-Fix-misparsing-of-maketext-strings.patch b/perl-5.17.6-Fix-misparsing-of-maketext-strings.patch new file mode 100644 index 0000000..9a8629f --- /dev/null +++ b/perl-5.17.6-Fix-misparsing-of-maketext-strings.patch @@ -0,0 +1,81 @@ +From 1735f6f53ca19f99c6e9e39496c486af323ba6a8 Mon Sep 17 00:00:00 2001 +From: Brian Carlson <brian.carlson(a)cpanel.net> +Date: Wed, 28 Nov 2012 08:54:33 -0500 +Subject: [PATCH] Fix misparsing of maketext strings. + +Case 61251: This commit fixes a misparse of maketext strings that could +lead to arbitrary code execution. Basically, maketext was compiling +bracket notation into functions, but neglected to escape backslashes +inside the content or die on fully-qualified method names when +generating the code. This change escapes all such backslashes and dies +when a method name with a colon or apostrophe is specified. +--- + AUTHORS | 1 + + dist/Locale-Maketext/lib/Locale/Maketext.pm | 24 ++++++++---------------- + 2 files changed, 9 insertions(+), 16 deletions(-) + +diff --git a/AUTHORS b/AUTHORS +index 70734b0..009dea0 100644 +--- a/AUTHORS ++++ b/AUTHORS +@@ -154,6 +154,7 @@ Breno G. de Oliveira <garu(a)cpan.org> + Brent Dax <brentdax(a)cpan.org> + Brooks D Boyd + Brian Callaghan <callagh(a)itginc.com> ++Brian Carlson <brian.carlson(a)cpanel.net> + Brian Clarke <clarke(a)appliedmeta.com> + brian d foy <brian.d.foy(a)gmail.com> + Brian Fraser <fraserbn(a)gmail.com> +diff --git a/dist/Locale-Maketext/lib/Locale/Maketext.pm b/dist/Locale-Maketext/lib/Locale/Maketext.pm +index 4822027..63e5fba 100644 +--- a/dist/Locale-Maketext/lib/Locale/Maketext.pm ++++ b/dist/Locale-Maketext/lib/Locale/Maketext.pm +@@ -625,21 +625,9 @@ sub _compile { + # 0-length method name means to just interpolate: + push @code, ' ('; + } +- elsif($m =~ /^\w+(?:\:\:\w+)*$/s +- and $m !~ m/(?:^|\:)\d/s +- # exclude starting a (sub)package or symbol with a digit ++ elsif($m =~ /^\w+$/s ++ # exclude anything fancy, especially fully-qualified module names + ) { +- # Yes, it even supports the demented (and undocumented?) +- # $obj->Foo::bar(...) syntax. +- $target->_die_pointing( +- $string_to_compile, q{Can't use "SUPER::" in a bracket-group method}, +- 2 + length($c[-1]) +- ) +- if $m =~ m/^SUPER::/s; +- # Because for SUPER:: to work, we'd have to compile this into +- # the right package, and that seems just not worth the bother, +- # unless someone convinces me otherwise. +- + push @code, ' $_[0]->' . $m . '('; + } + else { +@@ -693,7 +681,9 @@ sub _compile { + elsif(substr($1,0,1) ne '~') { + # it's stuff not containing "~" or "[" or "]" + # i.e., a literal blob +- $c[-1] .= $1; ++ my $text = $1; ++ $text =~ s/\\/\\\\/g; ++ $c[-1] .= $text; + + } + elsif($1 eq '~~') { # "~~" +@@ -731,7 +721,9 @@ sub _compile { + else { + # It's a "~X" where X is not a special character. + # Consider it a literal ~ and X. +- $c[-1] .= $1; ++ my $text = $1; ++ $text =~ s/\\/\\\\/g; ++ $c[-1] .= $text; + } + } + } +-- +1.7.11.7 + diff --git a/perl.spec b/perl.spec index d071ddc..1ed6a6c 100644 --- a/perl.spec +++ b/perl.spec @@ -29,7 +29,7 @@ Name: perl Version: %{perl_version} # release number must be even higher, because dual-lived modules will be broken otherwise -Release: 245%{?dist} +Release: 246%{?dist} Epoch: %{perl_epoch} Summary: Practical Extraction and Report Language Group: Development/Languages @@ -109,6 +109,9 @@ Patch18: perl-5.16.1-perl-114984-Glob.xs-Extend-stack-when-returning.patc # Do not crash when vivifying $|, rhbz#865296, RT#115206 Patch19: perl-5.16.1-perl-115206-Don-t-crash-when-vivifying.patch +# Fix CVE-2012-6329, rhbz#884354 +Patch20: perl-5.17.6-Fix-misparsing-of-maketext-strings.patch + # Update some of the bundled modules # see http://fedoraproject.org/wiki/Perl/perl.spec for instructions @@ -1381,6 +1384,7 @@ tarball from perl.org. %patch17 -p1 %patch18 -p1 %patch19 -p1 +%patch20 -p1 #copy the example script cp -a %{SOURCE5} . @@ -1591,6 +1595,7 @@ pushd %{build_archlib}/CORE/ 'Fedora Patch17: Allow operator after numeric keyword argument (RT#105924)' \ 'Fedora Patch18: Extend stack in File::Glob::glob, (RT#114984)' \ 'Fedora Patch19: Do not crash when vivifying $|' \ + 'Fedora Patch20: Fix misparsing of maketext strings (CVE-2012-6329)' \ %{nil} rm patchlevel.bak @@ -2745,6 +2750,9 @@ sed \ # Old changelog entries are preserved in CVS. %changelog +* Fri Jan 11 2013 Petr Pisar <ppisar(a)redhat.com> - 4:5.16.2-246 +- Fix CVE-2012-6329 (misparsing of maketext strings) (bug #884354) + * Thu Jan 10 2013 Petr Pisar <ppisar(a)redhat.com> - 4:5.16.2-245 - Do not package App::Cpan(3pm) to perl-Test-Harness (bug #893768)

1 0

[Bug 894270] New: perl-Growl-GNTP-0.16 is available
by Red Hat Bugzilla 11 Jan '13

11 Jan '13

Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=894270 Bug ID: 894270 Summary: perl-Growl-GNTP-0.16 is available Product: Fedora Version: rawhide Component: perl-Growl-GNTP Keywords: FutureFeature, Triaged Severity: unspecified Priority: unspecified Reporter: upstream-release-monitoring(a)fedoraproject.org Latest upstream release: 0.16 Current version in Fedora Rawhide: 0.15 URL: http://search.cpan.org/dist/Growl-GNTP/ Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=IxLJAcJ5P0&a=cc_unsubscribe

1 1

[perl-Growl-GNTP] Upstream release 0.16
by Miro Hrončok 11 Jan '13

11 Jan '13

commit 3182ceb46db57938a13bc148ff58eeeec5be1400 Author: Miro Hrončok <miro(a)hroncok.cz> Date: Fri Jan 11 13:17:18 2013 +0100 Upstream release 0.16 .gitignore | 1 + perl-Growl-GNTP.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) --- diff --git a/.gitignore b/.gitignore index 1ddaa26..e63ab71 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ /Growl-GNTP-0.15.tar.gz +/Growl-GNTP-0.16.tar.gz diff --git a/perl-Growl-GNTP.spec b/perl-Growl-GNTP.spec index 03bc5cb..8d0ae4d 100644 --- a/perl-Growl-GNTP.spec +++ b/perl-Growl-GNTP.spec @@ -1,6 +1,6 @@ Name: perl-Growl-GNTP -Version: 0.15 -Release: 4%{?dist} +Version: 0.16 +Release: 1%{?dist} Summary: Perl implementation of GNTP Protocol (Client Part) License: GPL+ or Artistic Group: Development/Libraries @@ -48,6 +48,9 @@ make test %{_mandir}/man3/* %changelog +* Fri Jan 11 2013 Miro Hrončok <mhroncok(a)redhat.com> - 0.16-1 +- New version + * Tue Nov 20 2012 Miro Hrončok <miro(a)hroncok.cz> - 0.15-4 - perl(inc::Module::Install) to perl(Module::Install) diff --git a/sources b/sources index 6f4d08a..a5f6b34 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -12e0588b267015d17ae258bf74874913 Growl-GNTP-0.15.tar.gz +c65c0d385c511979001eb0b55d90d159 Growl-GNTP-0.16.tar.gz

1 0

← Newer
1
...
54
55
56
57
58
59
60
...
79
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

perl-devel January 2013