[AutoPR- Security] Patch perl for CVE-2026-57433 [CRITICAL]

SPECS/perl/CVE-2026-57433.patch

@@ -0,0 +1,45 @@
+From 73b475027e344cf3ed284faf577b895771c9899d Mon Sep 17 00:00:00 2001
+From: AllSpark <allspark@microsoft.com>
+Date: Thu, 16 Jul 2026 20:50:50 +0000
+Subject: [PATCH] Storable.xs: Avoid signed int overflow when unpacking a list
+ of hook data items
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: AI Backport of https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch
+---
+ dist/Storable/Storable.pm | 2 +-
+ dist/Storable/Storable.xs | 5 ++++-
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/dist/Storable/Storable.pm b/dist/Storable/Storable.pm
+index d531f2b..665fd30 100644
+--- a/dist/Storable/Storable.pm
++++ b/dist/Storable/Storable.pm
+@@ -28,7 +28,7 @@ our @EXPORT_OK = qw(
+ our ($canonical, $forgive_me);
+
+ BEGIN {
+-  our $VERSION = '3.32';
++  our $VERSION = '3.41';
+ }
+
+ our $recursion_limit;
+diff --git a/dist/Storable/Storable.xs b/dist/Storable/Storable.xs
+index a558dd7..387b55f 100644
+--- a/dist/Storable/Storable.xs
++++ b/dist/Storable/Storable.xs
+@@ -5037,7 +5037,10 @@ static SV *retrieve_hook_common(pTHX_ stcxt_t *cxt, const char *cname, int large
+ 	}
+ 	else
+             GETMARK(len3);
+-        if (len3) {
++        if (len3 == I32_MAX)
++            /* If len3 is exactly I32_MAX it will upset av_extend below */
++            CROAK(("Invalid count of hook data items"));
++        else if (len3) {
+             av = newAV();
+             av_extend(av, len3 + 1);	/* Leave room for [0] */
+             AvFILLp(av) = len3;		/* About to be filled anyway */
+-- 
+2.45.4
+

SPECS/perl/perl.spec

@@ -127,7 +127,7 @@ License:        GPL+ or Artistic
 Epoch:          %{perl_epoch}
 Version:        %{perl_version}
 # release number must be even higher, because dual-lived modules will be broken otherwise
-Release:        513%{?dist}
+Release:        514%{?dist}
 Summary:        Practical Extraction and Report Language
 Url:            https://www.perl.org/
 Vendor:         Microsoft Corporation
@@ -198,6 +198,7 @@ Patch209:       CVE-2026-12087.patch
 Patch210:       CVE-2026-8376.patch
 Patch211:       CVE-2026-13221.patch
 Patch212:       CVE-2026-57432.patch
+Patch213:       CVE-2026-57433.patch
 
 # Update some of the bundled modules
 # see http://fedoraproject.org/wiki/Perl/perl.spec for instructions
@@ -6853,6 +6854,9 @@ popd
 %{_mandir}/man3/vmsish.*
 # Old changelog entries are preserved in CVS.
 %changelog
+* Thu Jul 16 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 4:5.38.2-514
+- Patch for CVE-2026-57433
+
 * Tue Jul 14 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 4:5.38.2-513
 - Patch for CVE-2026-57432, CVE-2026-13221
 

toolkit/resources/manifests/package/pkggen_core_aarch64.txt

@@ -107,64 +107,64 @@ libpipeline-devel-1.5.7-1.azl3.aarch64.rpm
 gdbm-1.23-1.azl3.aarch64.rpm
 gdbm-devel-1.23-1.azl3.aarch64.rpm
 gdbm-lang-1.23-1.azl3.aarch64.rpm
-perl-B-1.88-513.azl3.aarch64.rpm
-perl-Carp-1.54-513.azl3.noarch.rpm
-perl-Class-Struct-0.68-513.azl3.noarch.rpm
-perl-Data-Dumper-2.188-513.azl3.aarch64.rpm
-perl-DynaLoader-1.54-513.azl3.aarch64.rpm
-perl-Encode-3.19-513.azl3.aarch64.rpm
-perl-Errno-1.37-513.azl3.aarch64.rpm
-perl-Exporter-5.77-513.azl3.noarch.rpm
-perl-Fcntl-1.15-513.azl3.aarch64.rpm
-perl-File-Basename-2.86-513.azl3.noarch.rpm
-perl-File-Compare-1.100.700-513.azl3.noarch.rpm
-perl-File-Copy-2.41-513.azl3.noarch.rpm
-perl-File-Path-2.18-513.azl3.noarch.rpm
-perl-File-Temp-0.231.100-513.azl3.noarch.rpm
-perl-File-stat-1.13-513.azl3.noarch.rpm
-perl-FileHandle-2.05-513.azl3.noarch.rpm
-perl-Getopt-Long-2.54-513.azl3.noarch.rpm
-perl-Getopt-Std-1.13-513.azl3.noarch.rpm
-perl-HTTP-Tiny-0.086-513.azl3.noarch.rpm
-perl-I18N-Langinfo-0.22-513.azl3.aarch64.rpm
-perl-IO-1.52-513.azl3.aarch64.rpm
-perl-IPC-Open3-1.22-513.azl3.noarch.rpm
-perl-MIME-Base64-3.16-513.azl3.aarch64.rpm
-perl-POSIX-2.13-513.azl3.aarch64.rpm
-perl-PathTools-3.89-513.azl3.aarch64.rpm
-perl-Pod-Escapes-1.07-513.azl3.noarch.rpm
-perl-Pod-Perldoc-3.28.01-513.azl3.noarch.rpm
-perl-Pod-Simple-3.43-513.azl3.noarch.rpm
-perl-Pod-Usage-2.03-513.azl3.noarch.rpm
-perl-Scalar-List-Utils-1.63-513.azl3.aarch64.rpm
-perl-SelectSaver-1.02-513.azl3.noarch.rpm
-perl-Socket-2.036-513.azl3.aarch64.rpm
-perl-Storable-3.32-513.azl3.aarch64.rpm
-perl-Symbol-1.09-513.azl3.noarch.rpm
-perl-Term-ANSIColor-5.01-513.azl3.noarch.rpm
-perl-Term-Cap-1.18-513.azl3.noarch.rpm
-perl-Text-ParseWords-3.31-513.azl3.noarch.rpm
-perl-Text-Tabs+Wrap-2021.0814-513.azl3.noarch.rpm
-perl-Thread-Queue-3.14-513.azl3.noarch.rpm
-perl-Time-Local-1.300-513.azl3.noarch.rpm
-perl-Unicode-Normalize-1.32-513.azl3.aarch64.rpm
-perl-base-2.27-513.azl3.noarch.rpm
-perl-constant-1.33-513.azl3.noarch.rpm
-perl-if-0.61.000-513.azl3.noarch.rpm
-perl-interpreter-5.38.2-513.azl3.aarch64.rpm
-perl-libs-5.38.2-513.azl3.aarch64.rpm
-perl-locale-1.10-513.azl3.noarch.rpm
-perl-macros-5.38.2-513.azl3.noarch.rpm
-perl-mro-1.28-513.azl3.aarch64.rpm
-perl-overload-1.37-513.azl3.noarch.rpm
-perl-overloading-0.02-513.azl3.noarch.rpm
-perl-parent-0.241-513.azl3.noarch.rpm
-perl-podlators-5.01-513.azl3.noarch.rpm
-perl-subs-1.04-513.azl3.noarch.rpm
-perl-threads-2.36-513.azl3.aarch64.rpm
-perl-threads-shared-1.68-513.azl3.aarch64.rpm
-perl-vars-1.05-513.azl3.noarch.rpm
-perl-5.38.2-513.azl3.aarch64.rpm
+perl-B-1.88-514.azl3.aarch64.rpm
+perl-Carp-1.54-514.azl3.noarch.rpm
+perl-Class-Struct-0.68-514.azl3.noarch.rpm
+perl-Data-Dumper-2.188-514.azl3.aarch64.rpm
+perl-DynaLoader-1.54-514.azl3.aarch64.rpm
+perl-Encode-3.19-514.azl3.aarch64.rpm
+perl-Errno-1.37-514.azl3.aarch64.rpm
+perl-Exporter-5.77-514.azl3.noarch.rpm
+perl-Fcntl-1.15-514.azl3.aarch64.rpm
+perl-File-Basename-2.86-514.azl3.noarch.rpm
+perl-File-Compare-1.100.700-514.azl3.noarch.rpm
+perl-File-Copy-2.41-514.azl3.noarch.rpm
+perl-File-Path-2.18-514.azl3.noarch.rpm
+perl-File-Temp-0.231.100-514.azl3.noarch.rpm
+perl-File-stat-1.13-514.azl3.noarch.rpm
+perl-FileHandle-2.05-514.azl3.noarch.rpm
+perl-Getopt-Long-2.54-514.azl3.noarch.rpm
+perl-Getopt-Std-1.13-514.azl3.noarch.rpm
+perl-HTTP-Tiny-0.086-514.azl3.noarch.rpm
+perl-I18N-Langinfo-0.22-514.azl3.aarch64.rpm
+perl-IO-1.52-514.azl3.aarch64.rpm
+perl-IPC-Open3-1.22-514.azl3.noarch.rpm
+perl-MIME-Base64-3.16-514.azl3.aarch64.rpm
+perl-POSIX-2.13-514.azl3.aarch64.rpm
+perl-PathTools-3.89-514.azl3.aarch64.rpm
+perl-Pod-Escapes-1.07-514.azl3.noarch.rpm
+perl-Pod-Perldoc-3.28.01-514.azl3.noarch.rpm
+perl-Pod-Simple-3.43-514.azl3.noarch.rpm
+perl-Pod-Usage-2.03-514.azl3.noarch.rpm
+perl-Scalar-List-Utils-1.63-514.azl3.aarch64.rpm
+perl-SelectSaver-1.02-514.azl3.noarch.rpm
+perl-Socket-2.036-514.azl3.aarch64.rpm
+perl-Storable-3.32-514.azl3.aarch64.rpm
+perl-Symbol-1.09-514.azl3.noarch.rpm
+perl-Term-ANSIColor-5.01-514.azl3.noarch.rpm
+perl-Term-Cap-1.18-514.azl3.noarch.rpm
+perl-Text-ParseWords-3.31-514.azl3.noarch.rpm
+perl-Text-Tabs+Wrap-2021.0814-514.azl3.noarch.rpm
+perl-Thread-Queue-3.14-514.azl3.noarch.rpm
+perl-Time-Local-1.300-514.azl3.noarch.rpm
+perl-Unicode-Normalize-1.32-514.azl3.aarch64.rpm
+perl-base-2.27-514.azl3.noarch.rpm
+perl-constant-1.33-514.azl3.noarch.rpm
+perl-if-0.61.000-514.azl3.noarch.rpm
+perl-interpreter-5.38.2-514.azl3.aarch64.rpm
+perl-libs-5.38.2-514.azl3.aarch64.rpm
+perl-locale-1.10-514.azl3.noarch.rpm
+perl-macros-5.38.2-514.azl3.noarch.rpm
+perl-mro-1.28-514.azl3.aarch64.rpm
+perl-overload-1.37-514.azl3.noarch.rpm
+perl-overloading-0.02-514.azl3.noarch.rpm
+perl-parent-0.241-514.azl3.noarch.rpm
+perl-podlators-5.01-514.azl3.noarch.rpm
+perl-subs-1.04-514.azl3.noarch.rpm
+perl-threads-2.36-514.azl3.aarch64.rpm
+perl-threads-shared-1.68-514.azl3.aarch64.rpm
+perl-vars-1.05-514.azl3.noarch.rpm
+perl-5.38.2-514.azl3.aarch64.rpm
 texinfo-7.0.3-1.azl3.aarch64.rpm
 gtk-doc-1.33.2-1.azl3.noarch.rpm
 autoconf-2.72-2.azl3.noarch.rpm

toolkit/resources/manifests/package/pkggen_core_x86_64.txt

@@ -107,64 +107,64 @@ libpipeline-devel-1.5.7-1.azl3.x86_64.rpm
 gdbm-1.23-1.azl3.x86_64.rpm
 gdbm-devel-1.23-1.azl3.x86_64.rpm
 gdbm-lang-1.23-1.azl3.x86_64.rpm
-perl-B-1.88-513.azl3.x86_64.rpm
-perl-Carp-1.54-513.azl3.noarch.rpm
-perl-Class-Struct-0.68-513.azl3.noarch.rpm
-perl-Data-Dumper-2.188-513.azl3.x86_64.rpm
-perl-DynaLoader-1.54-513.azl3.x86_64.rpm
-perl-Encode-3.19-513.azl3.x86_64.rpm
-perl-Errno-1.37-513.azl3.x86_64.rpm
-perl-Exporter-5.77-513.azl3.noarch.rpm
-perl-Fcntl-1.15-513.azl3.x86_64.rpm
-perl-File-Basename-2.86-513.azl3.noarch.rpm
-perl-File-Compare-1.100.700-513.azl3.noarch.rpm
-perl-File-Copy-2.41-513.azl3.noarch.rpm
-perl-File-Path-2.18-513.azl3.noarch.rpm
-perl-File-Temp-0.231.100-513.azl3.noarch.rpm
-perl-File-stat-1.13-513.azl3.noarch.rpm
-perl-FileHandle-2.05-513.azl3.noarch.rpm
-perl-Getopt-Long-2.54-513.azl3.noarch.rpm
-perl-Getopt-Std-1.13-513.azl3.noarch.rpm
-perl-HTTP-Tiny-0.086-513.azl3.noarch.rpm
-perl-I18N-Langinfo-0.22-513.azl3.x86_64.rpm
-perl-IO-1.52-513.azl3.x86_64.rpm
-perl-IPC-Open3-1.22-513.azl3.noarch.rpm
-perl-MIME-Base64-3.16-513.azl3.x86_64.rpm
-perl-POSIX-2.13-513.azl3.x86_64.rpm
-perl-PathTools-3.89-513.azl3.x86_64.rpm
-perl-Pod-Escapes-1.07-513.azl3.noarch.rpm
-perl-Pod-Perldoc-3.28.01-513.azl3.noarch.rpm
-perl-Pod-Simple-3.43-513.azl3.noarch.rpm
-perl-Pod-Usage-2.03-513.azl3.noarch.rpm
-perl-Scalar-List-Utils-1.63-513.azl3.x86_64.rpm
-perl-SelectSaver-1.02-513.azl3.noarch.rpm
-perl-Socket-2.036-513.azl3.x86_64.rpm
-perl-Storable-3.32-513.azl3.x86_64.rpm
-perl-Symbol-1.09-513.azl3.noarch.rpm
-perl-Term-ANSIColor-5.01-513.azl3.noarch.rpm
-perl-Term-Cap-1.18-513.azl3.noarch.rpm
-perl-Text-ParseWords-3.31-513.azl3.noarch.rpm
-perl-Text-Tabs+Wrap-2021.0814-513.azl3.noarch.rpm
-perl-Thread-Queue-3.14-513.azl3.noarch.rpm
-perl-Time-Local-1.300-513.azl3.noarch.rpm
-perl-Unicode-Normalize-1.32-513.azl3.x86_64.rpm
-perl-base-2.27-513.azl3.noarch.rpm
-perl-constant-1.33-513.azl3.noarch.rpm
-perl-if-0.61.000-513.azl3.noarch.rpm
-perl-interpreter-5.38.2-513.azl3.x86_64.rpm
-perl-libs-5.38.2-513.azl3.x86_64.rpm
-perl-locale-1.10-513.azl3.noarch.rpm
-perl-macros-5.38.2-513.azl3.noarch.rpm
-perl-mro-1.28-513.azl3.x86_64.rpm
-perl-overload-1.37-513.azl3.noarch.rpm
-perl-overloading-0.02-513.azl3.noarch.rpm
-perl-parent-0.241-513.azl3.noarch.rpm
-perl-podlators-5.01-513.azl3.noarch.rpm
-perl-subs-1.04-513.azl3.noarch.rpm
-perl-threads-2.36-513.azl3.x86_64.rpm
-perl-threads-shared-1.68-513.azl3.x86_64.rpm
-perl-vars-1.05-513.azl3.noarch.rpm
-perl-5.38.2-513.azl3.x86_64.rpm
+perl-B-1.88-514.azl3.x86_64.rpm
+perl-Carp-1.54-514.azl3.noarch.rpm
+perl-Class-Struct-0.68-514.azl3.noarch.rpm
+perl-Data-Dumper-2.188-514.azl3.x86_64.rpm
+perl-DynaLoader-1.54-514.azl3.x86_64.rpm
+perl-Encode-3.19-514.azl3.x86_64.rpm
+perl-Errno-1.37-514.azl3.x86_64.rpm
+perl-Exporter-5.77-514.azl3.noarch.rpm
+perl-Fcntl-1.15-514.azl3.x86_64.rpm
+perl-File-Basename-2.86-514.azl3.noarch.rpm
+perl-File-Compare-1.100.700-514.azl3.noarch.rpm
+perl-File-Copy-2.41-514.azl3.noarch.rpm
+perl-File-Path-2.18-514.azl3.noarch.rpm
+perl-File-Temp-0.231.100-514.azl3.noarch.rpm
+perl-File-stat-1.13-514.azl3.noarch.rpm
+perl-FileHandle-2.05-514.azl3.noarch.rpm
+perl-Getopt-Long-2.54-514.azl3.noarch.rpm
+perl-Getopt-Std-1.13-514.azl3.noarch.rpm
+perl-HTTP-Tiny-0.086-514.azl3.noarch.rpm
+perl-I18N-Langinfo-0.22-514.azl3.x86_64.rpm
+perl-IO-1.52-514.azl3.x86_64.rpm
+perl-IPC-Open3-1.22-514.azl3.noarch.rpm
+perl-MIME-Base64-3.16-514.azl3.x86_64.rpm
+perl-POSIX-2.13-514.azl3.x86_64.rpm
+perl-PathTools-3.89-514.azl3.x86_64.rpm
+perl-Pod-Escapes-1.07-514.azl3.noarch.rpm
+perl-Pod-Perldoc-3.28.01-514.azl3.noarch.rpm
+perl-Pod-Simple-3.43-514.azl3.noarch.rpm
+perl-Pod-Usage-2.03-514.azl3.noarch.rpm
+perl-Scalar-List-Utils-1.63-514.azl3.x86_64.rpm
+perl-SelectSaver-1.02-514.azl3.noarch.rpm
+perl-Socket-2.036-514.azl3.x86_64.rpm
+perl-Storable-3.32-514.azl3.x86_64.rpm
+perl-Symbol-1.09-514.azl3.noarch.rpm
+perl-Term-ANSIColor-5.01-514.azl3.noarch.rpm
+perl-Term-Cap-1.18-514.azl3.noarch.rpm
+perl-Text-ParseWords-3.31-514.azl3.noarch.rpm
+perl-Text-Tabs+Wrap-2021.0814-514.azl3.noarch.rpm
+perl-Thread-Queue-3.14-514.azl3.noarch.rpm
+perl-Time-Local-1.300-514.azl3.noarch.rpm
+perl-Unicode-Normalize-1.32-514.azl3.x86_64.rpm
+perl-base-2.27-514.azl3.noarch.rpm
+perl-constant-1.33-514.azl3.noarch.rpm
+perl-if-0.61.000-514.azl3.noarch.rpm
+perl-interpreter-5.38.2-514.azl3.x86_64.rpm
+perl-libs-5.38.2-514.azl3.x86_64.rpm
+perl-locale-1.10-514.azl3.noarch.rpm
+perl-macros-5.38.2-514.azl3.noarch.rpm
+perl-mro-1.28-514.azl3.x86_64.rpm
+perl-overload-1.37-514.azl3.noarch.rpm
+perl-overloading-0.02-514.azl3.noarch.rpm
+perl-parent-0.241-514.azl3.noarch.rpm
+perl-podlators-5.01-514.azl3.noarch.rpm
+perl-subs-1.04-514.azl3.noarch.rpm
+perl-threads-2.36-514.azl3.x86_64.rpm
+perl-threads-shared-1.68-514.azl3.x86_64.rpm
+perl-vars-1.05-514.azl3.noarch.rpm
+perl-5.38.2-514.azl3.x86_64.rpm
 texinfo-7.0.3-1.azl3.x86_64.rpm
 gtk-doc-1.33.2-1.azl3.noarch.rpm
 autoconf-2.72-2.azl3.noarch.rpm