Does not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.
Does not properly preserve the taint attribute of data, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.
case_tolerant() on Cygwin will now avoid a painful death when Cygwin::mount_flags() isn't defined, as is the case for perl < 5.10. It will now just return 1, which is what it always did before it got so smart. [Spotted by Emanuele Zeppieri]
abs_path() on Unix(ish) platforms has been upgraded to a much later version of the underlying C code from BSD. [Michael Schwern]