[Buildroot] [PATCH] package/perl: security bump to version 5.42.3

[Buildroot] [PATCH] package/perl: security bump to version 5.42.3

[Francois Perrad]

fix CVE-2026-8376 - Buffer overflow in Perl_study_chunk
fix CVE-2026-57432 - Buffer overflow in S_measure_struct
fix CVE-2026-13221 - Regex trie 16-bit field overflow

For release notes, see:
https://perldoc.perl.org/5.42.3/perl5423delta

Signed-off-by: Francois Perrad <francois.perrad.86@gmail.com>
---
 package/perl/perl.hash | 8 ++++----
 package/perl/perl.mk   | 4 ++--
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/package/perl/perl.hash b/package/perl/perl.hash
index d88de6c42..7649ec47c 100644
--- a/package/perl/perl.hash
+++ b/package/perl/perl.hash
@@ -1,7 +1,7 @@
-# Hashes from: https://www.cpan.org/src/5.0/perl-5.42.2.tar.xz.{md5,sha1,sha256}.txt
-md5  be6e70b71ec6589fc090f7303c5b3056  perl-5.42.2.tar.xz
-sha1  dc36549204ec31680e1c7c0acb37fad0de83a339  perl-5.42.2.tar.xz
-sha256  0a585eeb9e363c0f80482ddb3571625250c2c86aeb408853e8ea50805cfb14bb  perl-5.42.2.tar.xz
+# Hashes from: https://www.cpan.org/src/5.0/perl-5.42.3.tar.xz.{md5,sha1,sha256}.txt
+md5  fb96e6cf064bf374e84ef232b0eda5c1  perl-5.42.3.tar.xz
+sha1  1d878802a55eacc778bb1d84b1f1b8ab9b22cc96  perl-5.42.3.tar.xz
+sha256  c9387e1473a1866935cb047ece7c2e0a80767a3acdecb79d4a375f8a95970ddc  perl-5.42.3.tar.xz
 
 # Hash from: https://github.com/arsv/perl-cross/releases/download/1.6.4/perl-cross-1.6.4.hash
 sha256  b6202173b0a8a43fb312867d85a8cd33527f3f234b1b6e591cdaa9895c9920c7  perl-cross-1.6.4.tar.gz
diff --git a/package/perl/perl.mk b/package/perl/perl.mk
index c96eb4413..912445ccc 100644
--- a/package/perl/perl.mk
+++ b/package/perl/perl.mk
@@ -6,7 +6,7 @@
 
 # When updating the version here, also update utils/scancpan
 PERL_VERSION_MAJOR = 42
-PERL_VERSION = 5.$(PERL_VERSION_MAJOR).2
+PERL_VERSION = 5.$(PERL_VERSION_MAJOR).3
 PERL_SITE = https://www.cpan.org/src/5.0
 PERL_SOURCE = perl-$(PERL_VERSION).tar.xz
 PERL_LICENSE = Artistic or GPL-1.0+
@@ -28,7 +28,7 @@ PERL_EXTRA_DOWNLOADS = $(PERL_CROSS_SITE)/$(PERL_CROSS_SOURCE)
 define PERL_CROSS_EXTRACT
 	$(call suitable-extractor,$(PERL_CROSS_SOURCE)) $(PERL_DL_DIR)/$(PERL_CROSS_SOURCE) | \
 	$(TAR) --strip-components=1 -C $(@D) $(TAR_OPTIONS) -
-	mv $(@D)/cnf/diffs/perl5-5.42.0 $(@D)/cnf/diffs/perl5-5.42.2
+	mv $(@D)/cnf/diffs/perl5-5.42.0 $(@D)/cnf/diffs/perl5-5.42.3
 endef
 PERL_POST_EXTRACT_HOOKS += PERL_CROSS_EXTRACT
 
-- 
2.43.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/perl: security bump to version 5.42.3

[Julien Olivain via buildroot]

On 03/08/2026 10:19, Francois Perrad wrote:
> fix CVE-2026-8376 - Buffer overflow in Perl_study_chunk
> fix CVE-2026-57432 - Buffer overflow in S_measure_struct
> fix CVE-2026-13221 - Regex trie 16-bit field overflow
> 
> For release notes, see:
> https://perldoc.perl.org/5.42.3/perl5423delta
> 
> Signed-off-by: Francois Perrad <francois.perrad.86@gmail.com>

Applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot