Security update for perl SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2025:20456-1 Final 1 1 2025-07-01T11:42:56Z current 2025-07-01T11:42:56Z 2025-07-01T11:42:56Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for perl This update for perl fixes the following issues: - CVE-2025-40909: Fixed a working directory race condition causing file operations to target unintended paths (bsc#1244079) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-Micro-6.0-372 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2025/suse-su-202520456-1/ Link for SUSE-SU-2025:20456-1 https://lists.suse.com/pipermail/sle-updates/2025-July/040617.html E-Mail link for SUSE-SU-2025:20456-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1244079 SUSE Bug 1244079 https://www.suse.com/security/cve/CVE-2025-40909/ SUSE CVE CVE-2025-40909 page SUSE Linux Micro 6.0 perl-5.38.2-4.1 perl-base-5.38.2-4.1 perl-5.38.2-4.1 as a component of SUSE Linux Micro 6.0 perl-base-5.38.2-4.1 as a component of SUSE Linux Micro 6.0 Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6 CVE-2025-40909 SUSE Linux Micro 6.0:perl-5.38.2-4.1 SUSE Linux Micro 6.0:perl-base-5.38.2-4.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202520456-1/ https://www.suse.com/security/cve/CVE-2025-40909.html CVE-2025-40909 https://bugzilla.suse.com/1244079 SUSE Bug 1244079