Security Advisories (28)
CVE-1999-0462 (1999-03-17)

suidperl in Linux Perl does not check the nosuid mount option on file systems, allowing local users to gain root access by placing a setuid script in a mountable file system, e.g. a CD-ROM or floppy disk.

CVE-2000-0703 (2000-10-20)

suidperl (aka sperl) does not properly cleanse the escape sequence "~!" before calling /bin/mail to send an error report, which allows local users to gain privileges by setting the "interactive" environmental variable and calling suidperl with a filename that contains the escape sequence.

CVE-2020-10543 (2020-06-05)

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

CVE-2016-1238 (2016-08-02)

(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.

CVE-2010-4777 (2014-02-10)

The Perl_reg_numbered_buff_fetch function in Perl 5.10.0, 5.12.0, 5.14.0, and other versions, when running with debugging enabled, allows context-dependent attackers to cause a denial of service (assertion failure and application exit) via crafted input that is not properly handled when using certain regular expressions, as demonstrated by causing SpamAssassin and OCSInventory to crash.

CVE-2012-5195 (2012-12-18)

Heap-based buffer overflow in the Perl_repeatcpy function in util.c in Perl 5.12.x before 5.12.5, 5.14.x before 5.14.3, and 5.15.x before 15.15.5 allows context-dependent attackers to cause a denial of service (memory consumption and crash) or possibly execute arbitrary code via the 'x' string repeat operator.

CVE-2023-47039 (2023-10-30)

Perl for Windows relies on the system path environment variable to find the shell (cmd.exe). When running an executable which uses Windows Perl interpreter, Perl attempts to find and execute cmd.exe within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. An attacker with limited privileges can exploit this behavior by placing cmd.exe in locations with weak permissions, such as C:\ProgramData. By doing so, when an administrator attempts to use this executable from these compromised locations, arbitrary code can be executed.

CVE-2018-18312 (2018-12-05)

Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2018-18311 (2018-12-07)

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2015-8853 (2016-05-25)

The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by "a\x80."

CVE-2008-1927 (2008-04-24)

Double free vulnerability in Perl 5.8.8 allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a crafted regular expression containing UTF8 characters. NOTE: this issue might only be present on certain operating systems.

CVE-2005-3962 (2005-12-01)

Integer overflow in the format string functionality (Perl_sv_vcatpvfn) in Perl 5.9.2 and 5.8.6 Perl allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via format string specifiers with large values, which causes an integer wrap and leads to a buffer overflow, as demonstrated using format string vulnerabilities in Perl applications.

CVE-2023-47100

In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a property name associated with a \p{...} regular expression construct is mishandled. The earliest affected version is 5.30.0.

CVE-2026-8376 (2026-05-25)

Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.

CVE-2015-8608 (2017-02-07)

The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.

CVE-2011-2728 (2012-12-21)

The bsd_glob function in the File::Glob module for Perl before 5.14.2 allows context-dependent attackers to cause a denial of service (crash) via a glob expression with the GLOB_ALTDIRFUNC flag, which triggers an uninitialized pointer dereference.

CVE-2020-12723 (2020-06-05)

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

CVE-2020-10878 (2020-06-05)

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

CVE-2018-6913 (2018-04-17)

Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count.

CVE-2018-18314 (2018-12-07)

Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2018-18313 (2018-12-07)

Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.

CVE-2013-1667 (2013-03-14)

The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key.

CVE-2010-1158 (2010-04-20)

Integer overflow in the regular expression engine in Perl 5.8.x allows context-dependent attackers to cause a denial of service (stack consumption and application crash) by matching a crafted regular expression against a long string.

CVE-2009-3626 (2009-10-29)

Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression match.

CVE-2007-5116 (2007-11-07)

Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in Perl 5.8 allows context-dependent attackers to execute arbitrary code by switching from byte to Unicode (UTF) characters in a regular expression.

CVE-2016-2381 (2016-04-08)

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

CVE-2013-7422 (2015-08-16)

Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression.

CVE-2011-1487 (2011-04-11)

The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.

NAME

perldelta - what's new for perl5.006 (as of 5.005_54)

DESCRIPTION

This document describes differences between the 5.005 release and this one.

Incompatible Changes

Perl Source Incompatibilities

None known at this time.

C Source Incompatibilities

PERL_POLLUTE

Release 5.005 grandfathered old global symbol names by providing preprocessor macros for extension source compatibility. As of release 5.006, these preprocessor definitions are not available by default. You need to explicitly compile perl with -DPERL_POLLUTE in order to get these definitions.

PERL_POLLUTE_MALLOC

Enabling the use of Perl's malloc in release 5.005 and earlier caused the namespace of system versions of the malloc family of functions to be usurped by the Perl versions of these functions, since they used the same names by default.

Besides causing problems on platforms that do not allow these functions to be cleanly replaced, this also meant that the system versions could not be called in programs that used Perl's malloc. Previous versions of Perl have allowed this behavior to be suppressed with the HIDEMYMALLOC and EMBEDMYMALLOC preprocessor definitions.

As of release 5.006, Perl's malloc family of functions have default names distinct from the system versions. You need to explicitly compile perl with -DPERL_POLLUTE_MALLOC in order to get the older behavior. HIDEMYMALLOC and EMBEDMYMALLOC have no effect, since the behavior they enabled is now the default.

Note that these functions do not constitute Perl's memory allocation API. See "Memory Allocation" in perlguts for further information about that.

PL_na and dTHR Issues

The PL_na global is now thread local, so a dTHR declaration is needed in the scope in which it appears. XSUBs should handle this automatically, but if you have used PL_na in support functions, you either need to change the PL_na to a local variable (which is recommended), or put in a dTHR.

Compatible C Source API Changes

PATCHLEVEL is now PERL_VERSION

The cpp macros PERL_REVISION, PERL_VERSION and PERL_SUBVERSION are now available by default from perl.h, and reflect the base revision, patchlevel and subversion respectively. PERL_REVISION had no prior equivalent, while PERL_VERSION and PERL_SUBVERSION were previously available as PATCHLEVEL and SUBVERSION.

The new names cause less pollution of the cpp namespace, and reflect what the numbers have come to stand for in common practice. For compatibility, the old names are still supported when patchlevel.h is explicitly included (as required before), so there is no source incompatibility due to the change.

Binary Incompatibilities

This release is not binary compatible with the 5.005 release and its maintenance versions.

Core Changes

Binary numbers supported

Binary numbers are now supported as literals, in s?printf formats, and oct():

$answer = 0b101010;
printf "The answer is: %b\n", oct("0b101010");

syswrite() ease-of-use

The length argument of syswrite() is now optional.

64-bit support

Better 64-bit support -- but full support still a distant goal. One must Configure with -Duse64bits to get Configure to probe for the extent of 64-bit support. Depending on the platform (hints file) more or less 64-awareness becomes available. As of 5.005_54 at least somewhat 64-bit aware platforms are HP-UX 11 or better, Solaris 2.6 or better, IRIX 6.2 or better. Naturally 64-bit platforms like Digital UNIX and UNICOS also have 64-bit support.

Better syntax checks on parenthesized unary operators

Expressions such as:

print defined(&foo,&bar,&baz);
print uc("foo","bar","baz");
undef($foo,&bar);

used to be accidentally allowed in earlier versions, and produced unpredictable behavior. Some of them produced ancillary warnings when used in this way, while others silently did the wrong thing.

The parenthesized forms of most unary operators that expect a single argument will now ensure that they are not called with more than one argument, making the above cases syntax errors. Note that the usual behavior of:

print defined &foo, &bar, &baz;
print uc "foo", "bar", "baz";
undef $foo, &bar;

remains unchanged. See perlop.

Improved qw// operator

The qw// operator is now evaluated at compile time into a true list instead of being replaced with a run time call to split(). This removes the confusing behavior of qw// in scalar context stemming from the older implementation, which inherited the behavior from split().

Thus:

$foo = ($bar) = qw(a b c); print "$foo|$bar\n";

now correctly prints "3|a", instead of "2|a".

pack() format 'Z' supported

The new format type 'Z' is useful for packing and unpacking null-terminated strings. See "pack" in perlfunc.

Significant bug fixes

<HANDLE> on empty files

With $/ set to undef, slurping an empty file returns a string of zero length (instead of undef, as it used to) for the first time the HANDLE is read. Subsequent reads yield undef.

This means that the following will append "foo" to an empty file (it used to not do anything before):

perl -0777 -pi -e 's/^/foo/' empty_file

Note that the behavior of:

perl -pi -e 's/^/foo/' empty_file

is unchanged (it continues to leave the file empty).

pack() format modifier '_' supported

The new format type modifer '_' is useful for packing and unpacking native shorts, ints, and longs. See "pack" in perlfunc.

Supported Platforms

  • VM/ESA is now supported.

  • Siemens BS200 is now supported.

  • The Mach CThreads (NeXTstep) are now supported by the Thread extension.

New tests

op/io_const

IO constants (SEEK_*, _IO*).

op/io_dir

Directory-related IO methods (new, read, close, rewind, tied delete).

op/io_multihomed

INET sockets with multi-homed hosts.

op/io_poll

IO poll().

op/io_unix

UNIX sockets.

op/filetest

File test operators.

op/lex_assign

Verify operations that access pad objects (lexicals and temporaries).

Modules and Pragmata

Modules

Dumpvalue

Added Dumpvalue module provides screen dumps of Perl data.

Benchmark

You can now run tests for x seconds instead of guessing the right number of tests to run.

Fcntl

More Fcntl constants added: F_SETLK64, F_SETLKW64, O_LARGEFILE for large (more than 4G) file access (the 64-bit support is not yet working, though, so no need to get overly excited), Free/Net/OpenBSD locking behaviour flags F_FLOCK, F_POSIX, Linux F_SHLCK, and O_ACCMODE: the mask of O_RDONLY, O_WRONLY, and O_RDWR.

Math::Complex

The accessors methods Re, Im, arg, abs, rho, theta, methods can ($z->Re()) now also act as mutators ($z->Re(3)).

Math::Trig

A little bit of radial trigonometry (cylindrical and spherical) added, for example the great circle distance.

Time::Local

The timelocal() and timegm() functions used to silently return bogus results when the date exceeded the machine's integer range. They consistently croak() if the date falls in an unsupported range.

Pragmata

Lexical warnings pragma, "use warning;", to control optional warnings.

Filetest pragma, to control the behaviour of filetests (-r -w ...). Currently only one subpragma implemented, "use filetest 'access';", that enables the use of access(2) or equivalent to check the permissions instead of using stat(2) as usual. This matters in filesystems where there are ACLs (access control lists), the stat(2) might lie, while access(2) knows better.

Utility Changes

Todo.

Documentation Changes

perlopentut.pod

A tutorial on using open() effectively.

perlreftut.pod

A tutorial that introduces the essentials of references.

New Diagnostics

/%s/: Unrecognized escape \\%c passed through

(W) You used a backslash-character combination which is not recognized by Perl. This combination appears in an interpolated variable or a '-delimited regular expression.

Unrecognized escape \\%c passed through

(W) You used a backslash-character combination which is not recognized by Perl.

Missing command in piped open

(W) You used the open(FH, "| command") or open(FH, "command |") construction, but the command was missing or blank.

Obsolete Diagnostics

Todo.

Configuration Changes

You can use "Configure -Uinstallusrbinperl" which causes installperl to skip installing perl also as /usr/bin/perl. This is useful if you prefer not to modify /usr/bin for some reason or another but harmful because many scripts assume to find Perl in /usr/bin/perl.

BUGS

If you find what you think is a bug, you might check the headers of recently posted articles in the comp.lang.perl.misc newsgroup. There may also be information at http://www.perl.com/perl/, the Perl Home Page.

If you believe you have an unreported bug, please run the perlbug program included with your release. Make sure you trim your bug down to a tiny but sufficient test case. Your bug report, along with the output of perl -V, will be sent off to <perlbug@perl.com> to be analysed by the Perl porting team.

SEE ALSO

The Changes file for exhaustive details on what changed.

The INSTALL file for how to build Perl.

The README file for general stuff.

The Artistic and Copying files for copyright information.

HISTORY

Written by Gurusamy Sarathy <gsar@umich.edu>, with many contributions from The Perl Porters.

Send omissions or corrections to <perlbug@perl.com>.

2 POD Errors

The following errors were encountered while parsing the POD:

Around line 296:

'=item' outside of any '=over'

Around line 312:

You forgot a '=back' before '=head1'