Stories
Slash Boxes
Comments
NOTE: use Perl; is on undef hiatus. You can read content, but you can't post it. More info will be forthcoming forthcomingly.

All the Perl that's Practical to Extract and Report

The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
 Full
 Abbreviated
 Hidden
More | Login | Reply
Loading... please wait.
  • If you look closely at the advisory, it states that it's original source is a Trustix [trustix.org] advisory. If you read the original it states that some of scripts contained in the Trustix packages handle temporary files in an insecure fashion, and this is the reason for the recommended upgrade. So the original wasn't a problem with Perl, but instead a problem with some particular scripts bundled with Perl (and ghostscript, glibc, groff, and many more).

    Unfortunately, this is a clear case of security-advisory Chinese-whispers. Problems with a particular distribution's package have instead been re-reported to be problems with Perl itself.

    The good news is that it is possible to go from the summary to the full advisory, and realise that the advice is intended only for those using the Trustix packages.

    • The good news is that it is possible to go from the summary to the full advisory, and realise that the advice is intended only for those using the Trustix packages.

      The bad news is that *almost* no one will bother to do so... So Perl will get the blame, true or not :-(