This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-107373 →
Categories
DEBIAN-CVE-2026-107373

ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument. The typem...

Original description

The description as published by the source.

ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument. The typemap uses $var = std::string( SvPV_nolen($arg), SvCUR($arg) ) However, evaluation order for C++ arguments is not specified, and some compilers may produce code that evalutes SvCUR($arg) first. When $arg is not a string (for example, an interger, number or a reference) then SvCUR will return an invalid value, and the program may abort or segfault.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 libextutils-typemaps-default-perl
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13 libextutils-typemaps-default-perl
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14 libextutils-typemaps-default-perl
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.07-1"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details