Security Advisories (26)
CVE-2016-1238 (2016-08-02)

(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.

CVE-2018-6913 (2018-04-17)

Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count.

CVE-2015-8853 (2016-05-25)

The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by "a\x80."

CVE-2009-3626 (2009-10-29)

Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression match.

CVE-2020-10878 (2020-06-05)

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

CVE-2018-18313 (2018-12-07)

Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.

CVE-2018-18312 (2018-12-05)

Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2026-57432 (2026-07-13)

Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.

CVE-2026-8376 (2026-05-25)

Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.

CVE-2015-8608 (2017-02-07)

The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.

CVE-2011-2728 (2012-12-21)

The bsd_glob function in the File::Glob module for Perl before 5.14.2 allows context-dependent attackers to cause a denial of service (crash) via a glob expression with the GLOB_ALTDIRFUNC flag, which triggers an uninitialized pointer dereference.

CVE-2020-12723 (2020-06-05)

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

CVE-2026-13221 (2026-07-13)

Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.

CVE-2026-4176 (2026-03-29)

Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.

CVE-2020-10543 (2020-06-05)

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

CVE-2018-18314 (2018-12-07)

Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2018-18311 (2018-12-07)

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2013-1667 (2013-03-14)

The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key.

CVE-2011-0761 (2011-05-13)

Perl 5.10.x allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an ability to inject arguments into a (1) getpeername, (2) readdir, (3) closedir, (4) getsockname, (5) rewinddir, (6) tell, or (7) telldir function call.

CVE-2010-4777 (2014-02-10)

The Perl_reg_numbered_buff_fetch function in Perl 5.10.0, 5.12.0, 5.14.0, and other versions, when running with debugging enabled, allows context-dependent attackers to cause a denial of service (assertion failure and application exit) via crafted input that is not properly handled when using certain regular expressions, as demonstrated by causing SpamAssassin and OCSInventory to crash.

CVE-2012-5195 (2012-12-18)

Heap-based buffer overflow in the Perl_repeatcpy function in util.c in Perl 5.12.x before 5.12.5, 5.14.x before 5.14.3, and 5.15.x before 15.15.5 allows context-dependent attackers to cause a denial of service (memory consumption and crash) or possibly execute arbitrary code via the 'x' string repeat operator.

CVE-2016-2381 (2016-04-08)

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

CVE-2013-7422 (2015-08-16)

Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression.

CVE-2011-1487 (2011-04-11)

The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.

CVE-2023-47039 (2023-10-30)

Perl for Windows relies on the system path environment variable to find the shell (cmd.exe). When running an executable which uses Windows Perl interpreter, Perl attempts to find and execute cmd.exe within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. An attacker with limited privileges can exploit this behavior by placing cmd.exe in locations with weak permissions, such as C:\ProgramData. By doing so, when an administrator attempts to use this executable from these compromised locations, arbitrary code can be executed.

CVE-2023-47100

In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a property name associated with a \p{...} regular expression construct is mishandled. The earliest affected version is 5.30.0.

NAME

cpan2dist - The CPANPLUS distribution creator

DESCRIPTION

This script will create distributions of CPAN modules of the format you specify, including its prerequisites. These packages can then be installed using the corresponding package manager for the format.

Note, you can also do this interactively from the default shell, CPANPLUS::Shell::Default. See the CPANPLUS::Dist documentation, as well as the documentation of your format of choice for any format specific documentation.

USAGE

Usage: cpan2dist [--format FMT] [OPTS] Mod::Name [Mod::Name, ...]
       cpan2dist [--format FMT] [OPTS] --modulelist /tmp/mods.list
       cpan2dist [--format FMT] [OPTS] --archive /tmp/dist [/tmp/dist2] 

   Will create a distribution of type FMT of the modules
   specified on the command line, and all their prerequisites.
   
   Can also create a distribution of type FMT from a local
   archive and all of its prerequisites.

Options:

### take no argument:
--help          Show this help message
--install       Install this package (and any prerequisites you built)
                after building it. 
--skiptest      Skip tests. Can be negated using --noskiptest
--force         Force operation. Can be negated using --noforce
--verbose       Be verbose. Can be negated using --noverbose
--keepsource    Keep sources after building distribution. Can be
                negated by --nokeepsource. May not be supported 
                by all formats
--makefile      Prefer Makefile.PL over Build.PL. Can be negated
                using --nomakefile. Defaults to your config setting
--buildprereq   Build packages of any prerequisites, even if they are
                already uptodate on the local system. Can be negated
                using --nobuildprereq. Defaults to false.
--archive       Indicate that all modules listed are actually archives
--flushcache    Update CPANPLUS' cache before commencing any operation
--defaults      Instruct ExtUtils::MakeMaker and Module::Build to use
                default answers during 'perl Makefile.PL' or 'perl
                Build.PL' calls where possible
--edit-metafile Edit the distributions metafile(s) before the distribution
                is built. Requires a configured editor.

### take argument:
--format      Installer format to use (defaults to config setting)
--ban         Patterns of module names to skip during installation,
              case-insensitive (affects prerequisites too)
              May be given multiple times
--banlist     File containing patterns that could be given to --ban
              Are appended to the ban list built up by --ban
              May be given multiple times.
--ignore      Patterns of modules to exclude from prereq list. Useful
              for when a prereq listed by a CPAN module is resolved 
              in another way than from its corresponding CPAN package
              (Match is done on both module name, and package name of
              the package the module is in, case-insensitive)
--ignorelist  File containing patterns that may be given to --ignore.
              Are appended to the ban list built up by --ignore.
              May be given multiple times.
--modulelist  File containing a list of modules that should be built.
              Are appended to the list of command line modules.
              May be given multiple times.
--logfile     File to log all output to. By default, all output goes
              to the console.
--timeout     The allowed time for buliding a distribution before
              aborting. This is useful to terminate any build that 
              hang or happen to be interactive despite being told not 
              to be. Defaults to 300 seconds. To turn off, you can 
              set it to 0.
--set-config  Change any options as specified in your config for this
              invocation only. See CPANPLUS::Config for a list of 
              supported options.
--set-program Change any programs as specified in your config for this
              invocation only. See CPANPLUS::Config for a list of 
              supported programs.
--dist-opts   Arbitrary options passed along to the chosen installer
              format's prepare()/create() routine. Please see the
              documentation of the installer of your choice for 
              options it accepts.

### builtin lists
--default-banlist    Use our builtin banlist. Works just like --ban
                     and --banlist, but with pre-set lists. See the
                     "Builtin Lists" section for details.
--default-ignorelist Use our builtin ignorelist. Works just like 
                     --ignore and --ignorelist but with pre-set lists. 
                     See the "Builtin Lists" section for details.

Examples:

### build a debian package of DBI and its prerequisites, 
### don't bother running tests
cpan2dist --format CPANPLUS::Dist::Deb --buildprereq --skiptest DBI

### build a debian package of DBI and its prerequisites and install them
cpan2dist --format CPANPLUS::Dist::Deb --buildprereq --install DBI

### Build a package, whose format is determined by your config, of 
### the local tarball, reloading cpanplus' indices first and using
### the tarballs Makefile.PL if it has one.
cpan2dist --makefile --flushcache --archive /path/to/Cwd-1.0.tgz

### build a package from Net::FTP, but dont build any packages or
### dependencies whose name match 'Foo', 'Bar' or any of the 
### patterns mentioned in /tmp/ban
cpan2dist --ban Foo --ban Bar --banlist /tmp/ban Net::FTP

### build a package from Net::FTP, but ignore its listed dependency
### on IO::Socket, as it's shipped per default with the OS we're on
cpan2dist --ignore IO::Socket Net::FTP

### building all modules listed, plus their prerequisites
cpan2dist --ignorelist /tmp/modules.ignore --banlist /tmp/modules.ban 
  --modulelist /tmp/modules.list --buildprereq --flushcache 
  --makefile --defaults

### pass arbitrary options to the format's prepare()/create() routine
cpan2dist --dist-opts deb_version=3 --dist-opts prefix=corp

Built-In Filter Lists

Some modules you'd rather not package. Some because they are part of core-perl and you dont want a new package. Some because they won't build on your system. Some because your package manager of choice already packages them for you.

There may be a myriad of reasons. You can use the --ignore and --ban options for this, but we provide some built-in lists that catch common cases. You can use these built-in lists if you like, or supply your own if need be.

Built-In Ignore List

You can use this list of regexes to ignore modules matching to be listed as prerequisites of a package. Particulaly useful if they are bundled with core-perl anyway and they have known issues building.

Toggle it by supplying the --default-ignorelist option.

^IO$                    # Provided with core anyway
^Cwd$                   # Provided with core anyway
^File::Spec             # Provided with core anyway
^Config$                # Perl's own config, not shipped separately
^ExtUtils::MakeMaker$   # Shipped with perl, recent versions 
                        # have bug 14721 (see rt.cpan.org)
^ExtUtils::Install$     # Part of of EU::MM, same reason    

Built-In Ban list

You can use this list of regexes to disable building of these modules altogether.

Toggle it by supplying the --default-banlist option.

^GD$                # Needs c libaries
^Berk.*DB           # DB packages require specific options & linking
^DBD::              # DBD drives require database files/headers
^XML::              # XML modules usually require expat libraries
Apache              # These usually require apache libraries
SSL                 # These usually require SSL certificates & libs
Image::Magick       # Needs ImageMagick C libraries
Mail::ClamAV        # Needs ClamAV C Libraries
^Verilog            # Needs Verilog C Libraries
^Authen::PAM$       # Needs PAM C libraries & Headers

SEE ALSO

CPANPLUS::Dist, CPANPLUS::Module, CPANPLUS::Shell::Default, cpanp

BUG REPORTS

Please report bugs or other issues to <bug-cpanplus@rt.cpan.org<gt>.

AUTHOR

This module by Jos Boumans <kane@cpan.org>.

COPYRIGHT

The CPAN++ interface (of which this module is a part of) is copyright (c) 2001 - 2007, Jos Boumans <kane@cpan.org>. All rights reserved.

This library is free software; you may redistribute and/or modify it under the same terms as Perl itself.