[BLFS Trac] #23217: Text-CSV_XS-1.62 (Perl Module)

#23217: Text-CSV_XS-1.62 (Perl Module)
-----------------------------+-----------------------
 Reporter:  Douglas R. Reno  |      Owner:  blfs-book
     Type:  enhancement      |     Status:  new
 Priority:  elevated         |  Milestone:  13.1
Component:  BOOK             |    Version:  git
 Severity:  normal           |   Keywords:
-----------------------------+-----------------------
 New minor version

 This contains a fix for CVE-2026-7111:

 {{{
 ========================================================================
 CVE-2026-7111                                        CPAN Security Group
 ========================================================================

         CVE ID:  CVE-2026-7111
   Distribution:  Text-CSV_XS
       Versions:  before 1.62

       MetaCPAN:  https://metacpan.org/dist/Text-CSV_XS
       VCS Repo:  https://github.com/cpan-authors/Text-CSV_XS


 Text::CSV_XS versions before 1.62 for Perl have a use-after-free when
 registered callbacks extend the Perl argument stack, which may enable
 type confusion or memory corruption

 Description
 -----------
 Text::CSV_XS versions before 1.62 for Perl have a use-after-free when
 registered callbacks extend the Perl argument stack, which may enable
 type confusion or memory corruption.

 The Parse, print, getline, and getline_all methods invoke registered
 callbacks (for example after_parse, before_print, or on_error) and
 cache the Perl argument stack pointer across the call. If a callback
 extends the argument stack enough to trigger a reallocation, the return
 value is written through the stale pointer into the freed buffer, and
 the caller reads the original $self argument as the return value
 instead.

 Calling code that expects parsed data from getline_all receives the
 Text::CSV_XS object in its place, leading to logic errors or crashes.
 Text::CSV_XS objects used without any registered callbacks are not
 affected.

 Problem types
 -------------
 - CWE-825 Expired Pointer Dereference
 - CWE-416 Use After Free

 Solutions
 ---------
 Upgrade to 1.62 or later.


 References
 ----------
 https://github.com/cpan-authors/Text-
 CSV_XS/commit/c17f31a5f2bf36674748eb4b6e25672f0571a224.patch
 https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.62/changes

 Timeline
 --------
 - 2026-04-25: Fix committed to public Github repository
 - 2026-04-26: CVE number reserved
 - 2026-04-29: Version 1.62 with the fix released to CPAN
 }}}
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/blfs/ticket/23217>
BLFS Trac <https://wiki.linuxfromscratch.org/blfs/>
Beyond Linux From Scratch

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-book
Unsubscribe: See the above information page