USN-8467-2: Perl vulnerabilities
Publication date
2 July 2026
Overview
Several security issues were fixed in Perl.
Releases
Packages
- perl - Practical Extraction and Report Language
Details
USN-8467-1 fixed vulnerabilities in Perl. This update provides the
corresponding fix for Perl on Ubuntu 25.10.
Original advisory details:
It was discovered that Perl's Archive::Tar module incorrectly handled
symlink and hardlink targets during extraction. An attacker could use this
issue to read or overwrite arbitrary files outside the extraction
directory. (CVE-2026-42496)
It was discovered that Perl had a heap buffer overflow when compiling
regular expressions with a repeated fixed string on 32-bit builds. An
attacker could use this issue to cause a denial of service or possibly
execute arbitrary code. (CVE-2026-8376)
USN-8467-1 fixed vulnerabilities in Perl. This update provides the
corresponding fix for Perl on Ubuntu 25.10.
Original advisory details:
It was discovered that Perl's Archive::Tar module incorrectly handled
symlink and hardlink targets during extraction. An attacker could use this
issue to read or overwrite arbitrary files outside the extraction
directory. (CVE-2026-42496)
It was discovered that Perl had a heap buffer overflow when compiling
regular expressions with a repeated fixed string on 32-bit builds. An
attacker could use this issue to cause a denial of service or possibly
execute arbitrary code. (CVE-2026-8376)
Update instructions
In general, a standard system update will make all the necessary changes.
Learn more about how to get the fixes.The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 25.10 questing | libperl-dev – 5.40.1-6ubuntu0.1 | ||
| libperl5.40 – 5.40.1-6ubuntu0.1 | |||
| perl – 5.40.1-6ubuntu0.1 | |||
| perl-base – 5.40.1-6ubuntu0.1 | |||
| perl-debug – 5.40.1-6ubuntu0.1 | |||
| perl-modules-5.40 – 5.40.1-6ubuntu0.1 | |||
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.