Mozilla::CA versions before 20261020 for Perl include a CA certificate bundle with a root certificate linked to compromised intermediate certificates. This bundle contains the "emSign ECC Root CA - G3" root, which enables trust paths to intermediates whose private keys are publicly known. An attacker who can intercept or redirect client traffic could use these keys to impersonate TLS servers. Perl clients using IO::Socket::SSL may fall back to this bundle if system CA stores are not used. Users should verify their CA store configuration and apply updates from their OS vendor if relying on the system store.
Text::CSV_XS versions before 1.65 for Perl have a vulnerability where parsing input that ends with a separator and a lone carriage return (CR) results in an unexpected 0xFF byte being returned for an empty last field. This malformed byte can cause issues in applications processing CSV data, especially with UTF-8 flagged input. The issue occurs when reading CRLF files line by line and the last column is empty, causing the application to receive a byte not present in the original input.
Text::CSV_XS versions before 1.65 for Perl contain a vulnerability where the function strip_trail_whitespace reads memory before the start of an all-blank field under the allow_whitespace setting. This can cause unintended memory modification when trailing spaces or tabs are processed, potentially leading to data corruption or other impacts. The issue occurs specifically when an all-blank field follows a leading escape character different from the quote character or appears as a quoted field ending with two carriage returns.
Text::CSV_XS versions before 1.65 for Perl contain a vulnerability where numeric strings with leading or trailing whitespace can be written without quotes, causing record splitting. This occurs because the combine and print functions do not verify if a field requires quotes when its value has Perl's numeric flag set. As a result, a numeric value containing a newline can prematurely end a CSV record and cause subsequent fields to be interpreted as a new row.
Text::CSV_XS versions before 1.65 for Perl have a vulnerability where the end of a record and its line ending are dropped when a UTF-8 flagged field precedes invalid UTF-8 bytes during print operations. This causes the next record to be written on the same line or misinterpreted as part of the previous field due to missing closing quotes.
Text::CSV_XS versions before 1.65 for Perl have a vulnerability causing quadratic CPU usage when processing CSV input with classic Mac (CR-only) line endings. This occurs because the parser repeatedly copies the unparsed remainder of the input after each record, leading to excessive CPU consumption on large inputs.
Text::CSV_XS versions before 1.65 for Perl have a memory leak vulnerability in the getline function. When parsing CSV records, if a record fails to parse due to syntax errors, the parsed fields are not freed, causing memory to be retained. This can lead to memory exhaustion in long-running processes handling untrusted malformed CSV input.
Text::CSV_XS versions from 1.46 up to but not including 1.65 for Perl contain a use-after-free vulnerability in the handling of bind_columns variables when skip_empty_rows skips an empty line in getline. This can cause the application to use freed memory and potentially crash.
Text::CSV_XS versions before 1.65 for Perl contain a vulnerability that allows memory exhaustion. The issue arises when processing RFC 7111 selectors in the fragment parameter, which can cause the module to allocate an excessively large array. This can lead to an out-of-memory error that terminates the process and cannot be caught by eval.