Security Advisories (26)
CVE-2009-3626 (2009-10-29)

Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression match.

CVE-2011-0761 (2011-05-13)

Perl 5.10.x allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an ability to inject arguments into a (1) getpeername, (2) readdir, (3) closedir, (4) getsockname, (5) rewinddir, (6) tell, or (7) telldir function call.

CVE-2023-47039 (2023-10-30)

Perl for Windows relies on the system path environment variable to find the shell (cmd.exe). When running an executable which uses Windows Perl interpreter, Perl attempts to find and execute cmd.exe within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. An attacker with limited privileges can exploit this behavior by placing cmd.exe in locations with weak permissions, such as C:\ProgramData. By doing so, when an administrator attempts to use this executable from these compromised locations, arbitrary code can be executed.

CVE-2023-47100

In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a property name associated with a \p{...} regular expression construct is mishandled. The earliest affected version is 5.30.0.

CVE-2026-4176 (2026-03-29)

Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.

CVE-2011-2728 (2012-12-21)

The bsd_glob function in the File::Glob module for Perl before 5.14.2 allows context-dependent attackers to cause a denial of service (crash) via a glob expression with the GLOB_ALTDIRFUNC flag, which triggers an uninitialized pointer dereference.

CVE-2026-8376 (2026-05-25)

Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.

CVE-2020-12723 (2020-06-05)

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

CVE-2020-10878 (2020-06-05)

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

CVE-2015-8853 (2016-05-25)

The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by "a\x80."

CVE-2013-1667 (2013-03-14)

The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key.

CVE-2012-5195 (2012-12-18)

Heap-based buffer overflow in the Perl_repeatcpy function in util.c in Perl 5.12.x before 5.12.5, 5.14.x before 5.14.3, and 5.15.x before 15.15.5 allows context-dependent attackers to cause a denial of service (memory consumption and crash) or possibly execute arbitrary code via the 'x' string repeat operator.

CVE-2013-7422 (2015-08-16)

Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression.

CVE-2020-10543 (2020-06-05)

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

CVE-2018-6913 (2018-04-17)

Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count.

CVE-2026-13221 (2026-07-13)

Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.

CVE-2026-57432 (2026-07-13)

Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.

CVE-2016-1238 (2016-08-02)

(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.

CVE-2015-8608 (2017-02-07)

The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.

CVE-2018-18314 (2018-12-07)

Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2018-18313 (2018-12-07)

Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.

CVE-2018-18312 (2018-12-05)

Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2018-18311 (2018-12-07)

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2010-4777 (2014-02-10)

The Perl_reg_numbered_buff_fetch function in Perl 5.10.0, 5.12.0, 5.14.0, and other versions, when running with debugging enabled, allows context-dependent attackers to cause a denial of service (assertion failure and application exit) via crafted input that is not properly handled when using certain regular expressions, as demonstrated by causing SpamAssassin and OCSInventory to crash.

CVE-2016-2381 (2016-04-08)

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

CVE-2011-1487 (2011-04-11)

The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.

NAME

prove - Run tests through a TAP harness.

USAGE

prove [options] [files or directories]

OPTIONS

Boolean options:

-v,  --verbose     Print all test lines.
-l,  --lib         Add 'lib' to the path for your tests (-Ilib).
-b,  --blib        Add 'blib/lib' and 'blib/arch' to the path for your tests
-s,  --shuffle     Run the tests in random order.
-c,  --color       Colored test output (default).
     --nocolor     Do not color test output.
     --count       Show the X/Y test count when not verbose (default)
     --nocount     Disable the X/Y test count.
-D   --dry         Dry run. Show test that would have run.
     --ext         Set the extension for tests (default '.t')
-f,  --failures    Show failed tests.
-o,  --comments    Show comments.
     --fork        Fork to run harness in multiple processes.
     --ignore-exit Ignore exit status from test scripts.
-m,  --merge       Merge test scripts' STDERR with their STDOUT.
-r,  --recurse     Recursively descend into directories.
     --reverse     Run the tests in reverse order.
-q,  --quiet       Suppress some test output while running tests.
-Q,  --QUIET       Only print summary results.
-p,  --parse       Show full list of TAP parse errors, if any.
     --directives  Only show results with TODO or SKIP directives.
     --timer       Print elapsed time after each test.
     --normalize   Normalize TAP output in verbose output
-T                 Enable tainting checks.
-t                 Enable tainting warnings.
-W                 Enable fatal warnings.
-w                 Enable warnings.
-h,  --help        Display this help
-?,                Display this help
-H,  --man         Longer manpage for prove
     --norc        Don't process default .proverc

Options that take arguments:

-I                 Library paths to include.
-P                 Load plugin (searches App::Prove::Plugin::*.)
-M                 Load a module.
-e,  --exec        Interpreter to run the tests ('' for compiled tests.)
     --harness     Define test harness to use.  See TAP::Harness.
     --formatter   Result formatter to use. See TAP::Harness.
-a,  --archive     Store the resulting TAP in an archive file.
-j,  --jobs N      Run N test jobs in parallel (try 9.)
     --state=opts  Control prove's persistent state.
     --rc=rcfile   Process options from rcfile

NOTES

.proverc

If ~/.proverc or ./.proverc exist they will be read and any options they contain processed before the command line options. Options in .proverc are specified in the same way as command line options:

# .proverc
--state=hot,fast,save
-j9 --fork

Additional option files may be specified with the --rc option. Default option file processing is disabled by the --norc option.

Under Windows and VMS the option file is named _proverc rather than .proverc and is sought only in the current directory.

Reading from STDIN

If you have a list of tests (or URLs, or anything else you want to test) in a file, you can add them to your tests by using a '-':

prove - < my_list_of_things_to_test.txt

See the README in the examples directory of this distribution.

Default Test Directory

If no files or directories are supplied, prove looks for all files matching the pattern t/*.t.

Colored Test Output

Colored test output is the default, but if output is not to a terminal, color is disabled. You can override this by adding the --color switch.

Color support requires Term::ANSIColor on Unix-like platforms and Win32::Console windows. If the necessary module is not installed colored output will not be available.

Exit Code

If the tests fail prove will exit with non-zero status.

Arguments to Tests

It is possible to supply arguments to tests. To do so separate them from prove's own arguments with the arisdottle, '::'. For example

prove -v t/mytest.t :: --url http://example.com

would run t/mytest.t with the options '--url http://example.com'. When running multiple tests they will each receive the same arguments.

--exec

Normally you can just pass a list of Perl tests and the harness will know how to execute them. However, if your tests are not written in Perl or if you want all tests invoked exactly the same way, use the -e, or --exec switch:

prove --exec '/usr/bin/ruby -w' t/
prove --exec '/usr/bin/perl -Tw -mstrict -Ilib' t/
prove --exec '/path/to/my/customer/exec'

--merge

If you need to make sure your diagnostics are displayed in the correct order relative to test results you can use the --merge option to merge the test scripts' STDERR into their STDOUT.

This guarantees that STDOUT (where the test results appear) and STDOUT (where the diagnostics appear) will stay in sync. The harness will display any diagnostics your tests emit on STDERR.

Caveat: this is a bit of a kludge. In particular note that if anything that appears on STDERR looks like a test result the test harness will get confused. Use this option only if you understand the consequences and can live with the risk.

--state

You can ask prove to remember the state of previous test runs and select and/or order the tests to be run based on that saved state.

The --state switch requires an argument which must be a comma separated list of one or more of the following options.

last

Run the same tests as the last time the state was saved. This makes it possible, for example, to recreate the ordering of a shuffled test.

# Run all tests in random order
$ prove -b --state=save --shuffle

# Run them again in the same order
$ prove -b --state=last
failed

Run only the tests that failed on the last run.

# Run all tests
$ prove -b --state=save

# Run failures
$ prove -b --state=failed

If you also specify the save option newly passing tests will be excluded from subsequent runs.

# Repeat until no more failures
$ prove -b --state=failed,save
passed

Run only the passed tests from last time. Useful to make sure that no new problems have been introduced.

all

Run all tests in normal order. Multple options may be specified, so to run all tests with the failures from last time first:

$ prove -b --state=failed,all,save
hot

Run the tests that most recently failed first. The last failure time of each test is stored. The hot option causes tests to be run in most-recent- failure order.

$ prove -b --state=hot,save

Tests that have never failed will not be selected. To run all tests with the most recently failed first use

$ prove -b --state=hot,all,save

This combination of options may also be specified thus

$ prove -b --state=adrian
todo

Run any tests with todos.

slow

Run the tests in slowest to fastest order. This is useful in conjunction with the -j parallel testing switch to ensure that your slowest tests start running first.

$ prove -b --state=slow -j9 
fast

Run test tests in fastest to slowest order.

new

Run the tests in newest to oldest order based on the modification times of the test scripts.

old

Run the tests in oldest to newest order.

fresh

Run those test scripts that have been modified since the last test run.

save

Save the state on exit. The state is stored in a file called .prove (_prove on Windows and VMS) in the current directory.

The --state switch may be used more than once.

$ prove -b --state=hot --state=all,save

@INC

prove introduces a separation between "options passed to the perl which runs prove" and "options passed to the perl which runs tests"; this distinction is by design. Thus the perl which is running a test starts with the default @INC. Additional library directories can be added via the PERL5LIB environment variable, via -Ifoo in PERL5OPT or via the -Ilib option to prove.

Taint Mode

Normally when a Perl program is run in taint mode the contents of the PERL5LIB environment variable do not appear in @INC.

Because PERL5LIB is often used during testing to add build directories to @INC prove (actually TAP::Parser::Source::Perl) passes the names of any directories found in PERL5LIB as -I switches. The net effect of this is that PERL5LIB is honoured even when prove is run in taint mode.

PLUGINS

Plugins can be loaded using the -Pplugin syntax, eg:

prove -PMyPlugin

This will search for a module named App::Prove::Plugin::MyPlugin, or failing that, MyPlugin. If the plugin can't be found, prove will complain & exit.

You can pass arguments to your plugin by appending =arg1,arg2,etc to the plugin name:

prove -PMyPlugin=fou,du,fafa

Please check individual plugin documentation for more details.

Available Plugins

For an up-to-date list of plugins available, please check CPAN:

http://search.cpan.org/search?query=App%3A%3AProve+Plugin

Writing Plugins

Please see "PLUGINS" in App::Prove.