perl-32bit-5.40.2-3.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2025:15258-1 Final 1 1 2025-07-03T00:00:00Z current 2025-07-03T00:00:00Z 2025-07-03T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z perl-32bit-5.40.2-3.1 on GA media These are all security issues fixed in the perl-32bit-5.40.2-3.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2025-15258 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2025-40909/ SUSE CVE CVE-2025-40909 page openSUSE Tumbleweed perl-5.40.2-3.1 perl-32bit-5.40.2-3.1 perl-base-5.40.2-3.1 perl-base-32bit-5.40.2-3.1 perl-doc-5.40.2-3.1 perl-5.40.2-3.1 as a component of openSUSE Tumbleweed perl-32bit-5.40.2-3.1 as a component of openSUSE Tumbleweed perl-base-5.40.2-3.1 as a component of openSUSE Tumbleweed perl-base-32bit-5.40.2-3.1 as a component of openSUSE Tumbleweed perl-doc-5.40.2-3.1 as a component of openSUSE Tumbleweed Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6 CVE-2025-40909 openSUSE Tumbleweed:perl-32bit-5.40.2-3.1 openSUSE Tumbleweed:perl-5.40.2-3.1 openSUSE Tumbleweed:perl-base-32bit-5.40.2-3.1 openSUSE Tumbleweed:perl-base-5.40.2-3.1 openSUSE Tumbleweed:perl-doc-5.40.2-3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-40909.html CVE-2025-40909 https://bugzilla.suse.com/1244079 SUSE Bug 1244079