/ 
perl-5.19.10
⭐ Starred 2013 / perl5193delta
Security Advisories (18)
CVE-2025-40909 (2025-05-30)

Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6

CVE-2015-8608 (2017-02-07)

The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.

CVE-2018-18312 (2018-12-05)

Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2015-8853 (2016-05-25)

The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by "a\x80."

CVE-2020-12723 (2020-06-05)

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

CVE-2020-10878 (2020-06-05)

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

CVE-2020-10543 (2020-06-05)

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

CVE-2018-6797 (2018-04-17)

An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow, with control over the bytes written.

CVE-2018-6913 (2018-04-17)

Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count.

CVE-2016-2381 (2016-04-08)

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

CVE-2016-1238 (2016-08-02)

(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.

CVE-2018-18314 (2018-12-07)

Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2018-18313 (2018-12-07)

Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.

CVE-2018-18311 (2018-12-07)

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2017-12837 (2017-09-19)

Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write) via a regular expression with a '\\N{}' escape and the case-insensitive modifier.

CVE-2013-7422 (2015-08-16)

Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression.

CVE-2023-47039 (2023-10-30)

Perl for Windows relies on the system path environment variable to find the shell (cmd.exe). When running an executable which uses Windows Perl interpreter, Perl attempts to find and execute cmd.exe within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. An attacker with limited privileges can exploit this behavior by placing cmd.exe in locations with weak permissions, such as C:\ProgramData. By doing so, when an administrator attempts to use this executable from these compromised locations, arbitrary code can be executed.

CVE-2023-47100

In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a property name associated with a \p{...} regular expression construct is mishandled. The earliest affected version is 5.30.0.

NAME

perl5193delta - what is new for perl v5.19.3

DESCRIPTION

This document describes differences between the 5.19.2 release and the 5.19.3 release.

If you are upgrading from an earlier release such as 5.19.1, first read perl5192delta, which describes differences between 5.19.1 and 5.19.2.

Core Enhancements

-F now implies -a and -a implies -n

Previously -F without -a was a no-op, and -a without -n or -p was a no-op, with this change, if you supply -F then both -a and -n are implied and if you supply -a then -n is implied.

You can still use -p for its extra behaviour. [perl #116190]

Security

Avoid possible read of free()d memory during parsing

It was possible that free()d memory could be read during parsing in the unusual circumstance of the Perl program ending with a heredoc and the last line of the file on disk having no terminating newline character. This has now been fixed.

Performance Enhancements

  • A performance regression introduced in Perl 5.11.2 in non-Unicode case-insensitive pattern matching has been largely resolved. In particular, the disabled optimization is now restored for every ASCII-range character. [perl #107816]

Modules and Pragmata

Updated Modules and Pragmata

  • B has been upgraded from version 1.44 to 1.45.

    Calling the GV method on B::CV objects created from a lexical sub would return nonsense, possibly crashing perl. GV now returns undef for lexical subs. [perl #118525]

    Added the NAME_HEK method to return the name of a lexical sub.

  • bignum has been upgraded from version 0.33 to 0.36.

    bigrat wasn't correctly updating an internal variable when used with a lib option.

  • Carp has been upgraded from 1.30 to 1.31

    Carp now handles objects with string overloads. It also allows objects to specify how they appear in the stack dump with a CARP_TRACE method, and also allows the user to specify their own formatter for objects without CARP_TRACE as well as other references. [perl #92446]

  • Compress::Raw::Bzip2 has been upgraded from 2.061 to 2.062.

    No changes have been made other than the version bump to keep in sync with other related modules.

  • Compress::Raw::Zlib has been upgraded from 2.061 to 2.062.

    A minor typo has been fixed in the documentation.

  • Config::Perl::V has been upgraded from version 0.18 to 0.19.

    The list of build options has been updated.

  • constant has been upgraded from version 1.27 to 1.28.

    Note that list constants will be inlined and may be read-only in future Perl versions.

  • CPAN::Meta has been upgraded from version 2.131560 to 2.132140.

    Some documentation typos have been fixed.

  • Data::Dumper has been upgraded from version 2.147 to 2.148.

    The compatibility of the XS implementation with the pure perl version under Useqq has been improved. [perl #118933]

  • DB has been upgraded from 1.41 to 1.42.

    The Perl debugger no longer crashes with PERLDB_OPTS="noTTY frame=2".

  • Devel::Peek has been upgraded from version 1.12 to 1.13.

    SvREFCNT_inc and SvREFCNT_dec have been removed and SvREFCNT will now work on non-scalars. [perl #117793]

    Dump now checks its arguments at compile time. Both arguments are now evaluated in scalar context, with exceptions for @arrays and %hashes, allowing aggregates to be dumped directly. The first argument is evaluated in rvalue scalar context, allowing rvalue pos and substr to be dumped.

    fill_mstats no longer crashes if its argument is not already a string. [perl #92260]

  • Devel::PPPort has been upgraded from version 3.20 to 3.21.

    Numerous updates and bug fixes are incorporated. See the Changes file for full details.

  • diagnostics has been upgraded from version 1.31 to 1.32.

    Wrapped links are no longer truncated.

  • DynaLoader has been upgraded from version 1.18 to 1.19.

    The $dl_dlext variable is now documented.

  • Encode has been upgraded from version 2.51 to 2.52.

    Encoding "0" with MIME-Headers no longer gets a blank string.

  • English has been upgraded from version 1.07 to 1.08.

    The documentation of a performance fix has been corrected.

  • Exporter has been upgraded from version 5.68 to 5.69.

    Exporter would ignore custom $SIG{__WARN__} handlers in Exporter::Heavy. [perl #39739]

  • ExtUtils::MakeMaker has been upgraded from 6.68 to 6.72.

    The dist target now reports the file created, an infinite loop in clean_subdirs has been fixed, an invisible interactive question is now avoided when rebuilding Makefile, issues with /cygdrive on Cygwin have been resolved, LD and OPTIMIZE are now used in recursive Makefile.PL invocations, VERSION and VERSION_FROM now handle v-strings correctly, and control characters are now stripped from ABSTRACT.

  • File::Spec has been upgraded from 3.41 to 3.44.

    The module is now partly implemented in XS, for performance.

  • Getopt::Std has been upgraded from version 1.09 to 1.10.

    Clarified documentation of what happens when a switch is expecting an argument but fails to be provided with one.

  • The IO-Compress module collection has been upgraded from 2.061 to 2.062.

    Some documentation typos have been fixed.

  • IPC::Cmd has been upgraded from version 0.82 to 0.84.

    run_forked has various fixes/improvements, Socket is only used where needed and a regression introduced in 0.78 has been fixed.

  • IPC::Open3 has been upgraded from version 1.14 to 1.15.

    open3 would leak a zombie process if the child process I/O redirection or exec failed. [perl #114722]

  • IPC::SysV has been upgraded from version 2.03 to 2.04.

    $EXPORT_TAGS{all} has been added and a couple of typos have been fixed.

  • The libnet module collection has been upgraded from version 1.22 to 1.23.

    Numerous bug fixes and documentation improvements have been made. See the Changes file for full details.

  • List::Util has been upgraded from version 1.27 to 1.31.

    List::Util now includes pairgrep, pairmap, pairs, pairkeys, pairvalues and pairfirst functions that operate on even-sized lists of pairs.

  • Module::Build has been upgraded from 0.4005 to 0.4007.

    The test suite has been significantly sped up, Unicode man page support has been enhanced and hash argument parsing in subclasses has been fixed.

  • Module::CoreList has been upgraded from 2.92 to 2.97.

    The list of Perl versions covered has been updated.

  • mro has been upgraded from version 1.12 to 1.13.

    A minor typo has been fixed in the documentation.

  • parent has been upgraded from version 0.225 to 0.226.

    Internal changes only have been made to the test suite.

  • PerlIO has been upgraded from version 1.07 to 1.08.

    Although not a security vulnerability, it was possible to inject code via PerlIO->import(). This has now been fixed. [perl #119287]

  • Pod::Functions has been upgraded from version 1.07 to 1.08.

    Internal changes only have been made to the test suite.

  • Socket has been upgraded from version 2.010 to 2.011.

    Handle FreeBSD (or other platforms) returning shorter AF_UNIX sockaddr structures due to embedded sun_len. [cpan #86613]

  • Storable has been upgraded from version 2.45 to 2.46.

    Avoid creating temporary objects for STORABLE_attach when they aren't required. [perl #118907]

  • Time::HiRes has been upgraded from version 1.9725 to 1.9726.

    An lstat function is now provided and various bugs have been fixed. See the Changes file for full details.

  • Time::Piece has been upgraded from version 1.21 to 1.22.

    A minor documentation encoding problem has been fixed.

  • utf8 has been upgraded from version 1.12 to 1.13.

    A minor clarification has been made in the documentation.

  • version has been upgraded from version 0.9902 to 0.9903.

    Various installation, testing and documentation changes have been made.

Documentation

Changes to Existing Documentation

perlfunc

  • The documentation of ref has been updated to recommend the use of blessed, isa and reftype when dealing with references to blessed objects.

perlguts

  • The explanation of the use of the SVs_PADMY and SVs_PADTMP flags in determining whether an SV lives on a scratchpad has been clarified.

perlopentut

  • The open tutorial has been completely rewritten by Tom Christiansen, and now focuses on covering only the basics, rather than providing a comprehensive reference to all things openable. This rewrite came as the result of a vigorous discussion on perl5-porters kicked off by a set of improvements written by Alexander Hartmaier to the existing perlopentut. A "more than you ever wanted to know about open" document may follow in subsequent versions of perl.

perlre

  • The /r modifier (for non-destructive substitution) is now documented. [perl #119151]

perlsub

  • The need to predeclare recursive functions with prototypes in order for the prototype to be honoured in the recursive call is now documented. [perl #2726]

perlvar

  • A new section explaining the performance issues of $`, $& and $', including workarounds and changes in different versions of Perl, has been added.

perlxs

  • Several problems in the MY_CXT example have been fixed.

Diagnostics

The following additions or changes have been made to diagnostic output, including warnings and fatal error messages. For the complete list of diagnostic messages, see perldiag.

New Diagnostics

New Errors

  • Magical list constants are not supported

    (F) You assigned a magical array to a stash element, and then tried to use the subroutine from the same slot. You are asking Perl to do something it cannot do, details subject to change between Perl versions.

New Warnings

Testing

  • The behaviour of pos on very large strings is now tested in the new test script t/bigmem/pos.t.

  • The test script t/porting/ss_dup.t has been created to test that ss_dup() handles all savestack items.

  • The new behaviour of -F and -a (see the "Core Enhancements" section) is tested in the new test script t/run/switchF2.t.

Internal Changes

  • sv_pos_b2u_flags has been added to the API. It is similar to sv_pos_b2u, but supports long strings on 64-bit platforms.

  • PL_exit_flags can now be used by perl embedders or other XS code to have perl warn or abort on an attempted exit. [perl #52000]

Selected Bug Fixes

  • Autovivifying a subroutine stub via \&$glob started causing crashes in Perl 5.18.0 if the $glob was merely a copy of a real glob, i.e., a scalar that had had a glob assigned to it. This has been fixed. [perl #119051]

  • On 64-bit platforms pos can now be set to a value higher than 2**31-1. [perl #72766]

  • Perl used to leak an implementation detail when it came to referencing the return values of certain operators. for ($a+$b) { warn \$_; warn \$_ } used to display two different memory addresses, because the \ operator was copying the variable. Under threaded builds, it would also happen for constants (for(1) { ... }). This has been fixed. [perl #21979, #78194, #89188, #109746, #114838, #115388]

  • The range operator .. was returning the same modifiable scalars with each call, unless it was the only thing in a foreach loop header. This meant that changes to values within the list returned would be visible the next time the operator was executed. [perl #3105]

  • Constant folding and subroutine inlining no longer cause operations that would normally return new modifiable scalars to return read-only values instead.

  • Closures of the form sub () { $some_variable } are no longer inlined, causing changes to the variable to be ignored by callers of the subroutine. [perl #79908]

  • Return values of certain operators such as ref would sometimes be shared between recursive calls to the same subroutine, causing the inner call to modify the value returned by ref in the outer call. This has been fixed.

  • __PACKAGE__ and constants returning a package name or hash key are now consistently read-only. In various previous Perl releases, they have become mutable under certain circumstances.

  • /$qr/p was broken in Perl 5.18.0; the /p flag was ignored. This has been fixed. [perl #118213]

  • Starting in Perl 5.18.0, a construct like /[#](?{})/x would have its # incorrectly interpreted as a comment. The code block would be skipped, unparsed. This has been corrected.

  • Starting in Perl 5.001, a regular expression like /[#$a]/x or /[#]$a/x would have its # incorrectly interpreted as a comment, so the variable would not interpolate. This has been corrected. [perl #45667]

  • On non-threaded builds, setting ${"_<filename"} to a reference or typeglob no longer causes __FILE__ and some error messages to produce a corrupt string, and no longer prevents #line directives in string evals from providing the source lines to the debugger. Threaded builds were unaffected.

  • Enabling "used once" warnings no longer causes crashes on stash circularities created at compile time (*Foo::Bar::Foo:: = *Foo::).

  • Undef constants used in hash keys (use constant u => undef; $h{+u}) no longer produce "uninitialized" warnings at compile time.

  • Modifying a substitution target inside the substitution replacement no longer causes crashes.

  • The first statement inside a string eval used to use the wrong pragma setting sometimes during constant folding. eval 'uc chr 0xe0' would randomly choose between Unicode, byte, and locale semantics. This has been fixed.

  • The handling of return values of @INC filters (subroutines returned by subroutines in @INC) has been fixed in various ways. Previously tied variables were mishandled, and setting $_ to a reference or typeglob could result in crashes.

  • The SvPVbyte XS function has been fixed to work with tied scalars returning something other than a string. It used to return utf8 in those cases where SvPV would.

  • Perl 5.18.0 inadvertently made dereferenced regular expressions (${ qr// }) false as booleans. This has been fixed.

  • Perl 5.18.0 inadvertently made -- and ++ crash on dereferenced regular expressions, and stopped ++ from flattening vstrings.

  • bless no longer dies with "Can't bless non-reference value" if its first argument is a tied reference.

  • reset with an argument no longer skips copy-on-write scalars, regular expressions, typeglob copies, and vstrings. Also, when encountering those or read-only values, it no longer skips any array or hash with the same name.

  • reset with an argument now skips scalars aliased to typeglobs (for $z (*foo) { reset "z" }). Previously it would corrupt memory or crash.

  • ucfirst and lcfirst were not respecting the bytes pragma. This was a regression from Perl 5.12. [perl #117355]

  • The use of \G in regular expressions, where it's not at the start of the pattern, is now slightly less buggy (although it is still somewhat problematic).

  • Where a regular expression included code blocks (/(?{...})/), and where the use of constant overloading triggered a re-compilation of the code block, the second compilation didn't see its outer lexical scope. This was a regression in Perl 5.18.0.

  • Changes to UNIVERSAL::DESTROY now update DESTROY caches in all classes, instead of causing classes that have already had objects destroyed to continue using the old sub. This was a regression in Perl 5.18. [perl #114864]

  • All known false-positive occurrences of the deprecation warning "Useless use of '\'; doesn't escape metacharacter '%c'", added in Perl 5.18.0, have been removed. [perl #119101]

Acknowledgements

Perl 5.19.3 represents approximately 4 weeks of development since Perl 5.19.2 and contains approximately 24,000 lines of changes across 710 files from 36 authors.

Perl continues to flourish into its third decade thanks to a vibrant community of users and developers. The following people are known to have contributed the improvements that became Perl 5.19.3:

Alexander Voronov, Andy Dougherty, Aristotle Pagaltzis, Brendan Byrd, Chris 'BinGOs' Williams, Colin Kuskie, Craig A. Berry, Daniel Dragan, Darin McBride, David Mitchell, Father Chrysostomos, H.Merijn Brand, James E Keenan, John Gardiner Myers, John Peacock, Karl Williamson, Lukas Mai, Marcus Holland-Moritz, Nathan Trapuzzano, Neil Bowers, Nicholas Clark, Peter Martini, Philip Boulain, Ricardo Signes, Sergey Alekseev, Shlomi Fish, Smylers, Steffen Müller, Steve Hay, Tom Christiansen, Tony Cook, Victor Efimov, Viktor Turskyi, Vladimir Timofeev, Yves Orton, Zefram.

The list above is almost certainly incomplete as it is automatically generated from version control history. In particular, it does not include the names of the (very much appreciated) contributors who reported issues to the Perl bug tracker.

Many of the changes included in this version originated in the CPAN modules included in Perl's core. We're grateful to the entire CPAN community for helping Perl to flourish.

For a more complete list of all of Perl's historical contributors, please see the AUTHORS file in the Perl source distribution.

Reporting Bugs

If you find what you think is a bug, you might check the articles recently posted to the comp.lang.perl.misc newsgroup and the perl bug database at http://rt.perl.org/perlbug/ . There may also be information at http://www.perl.org/ , the Perl Home Page.

If you believe you have an unreported bug, please run the perlbug program included with your release. Be sure to trim your bug down to a tiny but sufficient test case. Your bug report, along with the output of perl -V, will be sent off to perlbug@perl.org to be analysed by the Perl porting team.

If the bug you are reporting has security implications, which make it inappropriate to send to a publicly archived mailing list, then please send it to perl5-security-report@perl.org. This points to a closed subscription unarchived mailing list, which includes all the core committers, who will be able to help assess the impact of issues, figure out a resolution, and help co-ordinate the release of patches to mitigate or fix the problem across all platforms on which Perl is supported. Please only use this address for security issues in the Perl core, not for modules independently distributed on CPAN.

SEE ALSO

The Changes file for an explanation of how to view exhaustive details on what changed.

The INSTALL file for how to build Perl.

The README file for general stuff.

The Artistic and Copying files for copyright information.