Security Advisories (18)
CVE-2013-1667 (2013-03-14)

The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key.

CVE-2012-5195 (2012-12-18)

Heap-based buffer overflow in the Perl_repeatcpy function in util.c in Perl 5.12.x before 5.12.5, 5.14.x before 5.14.3, and 5.15.x before 15.15.5 allows context-dependent attackers to cause a denial of service (memory consumption and crash) or possibly execute arbitrary code via the 'x' string repeat operator.

CVE-2023-47039 (2023-10-30)

Perl for Windows relies on the system path environment variable to find the shell (cmd.exe). When running an executable which uses Windows Perl interpreter, Perl attempts to find and execute cmd.exe within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. An attacker with limited privileges can exploit this behavior by placing cmd.exe in locations with weak permissions, such as C:\ProgramData. By doing so, when an administrator attempts to use this executable from these compromised locations, arbitrary code can be executed.

CVE-2023-47100

In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a property name associated with a \p{...} regular expression construct is mishandled. The earliest affected version is 5.30.0.

CVE-2018-18314 (2018-12-07)

Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2020-12723 (2020-06-05)

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

CVE-2013-7422 (2015-08-16)

Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression.

CVE-2025-40909 (2025-05-30)

Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6

CVE-2016-1238 (2016-08-02)

(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.

CVE-2015-8608 (2017-02-07)

The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.

CVE-2020-10878 (2020-06-05)

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

CVE-2020-10543 (2020-06-05)

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

CVE-2018-6913 (2018-04-17)

Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count.

CVE-2018-18313 (2018-12-07)

Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.

CVE-2018-18312 (2018-12-05)

Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2018-18311 (2018-12-07)

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2015-8853 (2016-05-25)

The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by "a\x80."

CVE-2016-2381 (2016-04-08)

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

NAME

perl5131delta - what is new for perl v5.13.1

DESCRIPTION

This document describes differences between the 5.13.0 release and the 5.13.1 release.

If you are upgrading from an earlier release such as 5.10, first read perl5120delta, which describes differences between 5.10 and 5.12.

Incompatible Changes

"\cX"

The backslash-c construct was designed as a way of specifying non-printable characters, but there were no restrictions (on ASCII platforms) on what the character following the c could be. Now, that character must be one of the ASCII characters.

localised tied hashes, arrays and scalars are no longed tied

In the following:

    tie @a, ...;
    {
	local @a;
	# here, @a is a now a new, untied array
    }
    # here, @a refers again to the old, tied array

The new local array used to be made tied too, which was fairly pointless, and has now been fixed. This fix could however potentially cause a change in behaviour of some code.

given return values

Starting from this release, given blocks returns the last evaluated expression, or an empty list if the block was exited by break. Thus you can now write:

my $type = do {
 given ($num) {
  break     when undef;
  'integer' when /^[+-]?[0-9]+$/;
  'float'   when /^[+-]?[0-9]+(?:\.[0-9]+)?$/;
  'unknown';
 }
};

See "Return value" in perlsyn for details.

Core Enhancements

Exception Handling Reliability

Several changes have been made to the way die, warn, and $@ behave, in order to make them more reliable and consistent.

When an exception is thrown inside an eval, the exception is no longer at risk of being clobbered by code running during unwinding (e.g., destructors). Previously, the exception was written into $@ early in the throwing process, and would be overwritten if eval was used internally in the destructor for an object that had to be freed while exiting from the outer eval. Now the exception is written into $@ last thing before exiting the outer eval, so the code running immediately thereafter can rely on the value in $@ correctly corresponding to that eval.

Likewise, a local $@ inside an eval will no longer clobber any exception thrown in its scope. Previously, the restoration of $@ upon unwinding would overwrite any exception being thrown. Now the exception gets to the eval anyway. So local $@ is safe inside an eval, albeit of rather limited use.

Exceptions thrown from object destructors no longer modify the $@ of the surrounding context. (If the surrounding context was exception unwinding, this used to be another way to clobber the exception being thrown. Due to the above change it no longer has that significance, but there are other situations where $@ is significant.) Previously such an exception was sometimes emitted as a warning, and then either string-appended to the surrounding $@ or completely replaced the surrounding $@, depending on whether that exception and the surrounding $@ were strings or objects. Now, an exception in this situation is always emitted as a warning, leaving the surrounding $@ untouched. In addition to object destructors, this also affects any function call performed by XS code using the G_KEEPERR flag.

$@ is also no longer used as an internal temporary variable when preparing to die. Previously it was internally necessary to put any exception object (any non-string exception) into $@ first, before it could be used as an exception. (The C API still offers the old option, so an XS module might still clobber $@ in the old way.) This change together with the foregoing means that, in various places, $@ may be observed to contain its previously-assigned value, rather than having been overwritten by recent exception-related activity.

Warnings for warn can now be objects, in the same way as exceptions for die. If an object-based warning gets the default handling, of writing to standard error, it will of course still be stringified along the way. But a $SIG{__WARN__} handler will now receive an object-based warning as an object, where previously it was passed the result of stringifying the object.

Modules and Pragmata

Updated Modules

Errno

The implementation of Errno has been refactored to use about 55% less memory. There should be no user-visible changes.

Perl 4 .pl libraries

These historical libraries have been minimally modified to avoid using $[. This is to prepare them for the deprecation of $[.

B::Deparse

A bug has been fixed when deparsing a nextstate op that has both a change of package (relative to the previous nextstate), or a change of %^H or other state, and a label. Previously the label was emitted first, leading to syntactically invalid output because a label is not permitted immediately before a package declaration, BEGIN block, or some other things. Now the label is emitted last.

Removed Modules and Pragmata

The following modules have been removed from the core distribution, and if needed should be installed from CPAN instead.

Class::ISA
Pod::Plainer
Switch

The removal of Shell has been deferred until after 5.14, as the implementation of Shell shipped with 5.12.0 did not correctly issue the warning that it was to be removed from core.

New Documentation

perlgpl

perlgpl has been updated to contain GPL version 1, as is included in the README distributed with perl.

Selected Bug Fixes

  • Naming a deprecated character in \N{...} will not leak memory.

  • FETCH is no longer called needlessly on some tied variables.

  • The trie runtime code should no longer allocate massive amounts of memory, fixing #74484.

Changed Internals

  • The protocol for unwinding the C stack at the last stage of a die has changed how it identifies the target stack frame. This now uses a separate variable PL_restartjmpenv, where previously it relied on the blk_eval.cur_top_env pointer in the eval context frame that has nominally just been discarded. This change means that code running during various stages of Perl-level unwinding no longer needs to take care to avoid destroying the ghost frame.

  • The format of entries on the scope stack has been changed, resulting in a reduction of memory usage of about 10%. In particular, the memory used by the scope stack to record each active lexical variable has been halved.

  • Memory allocation for pointer tables has been changed. Previously Perl_ptr_table_store allocated memory from the same arena system as SV bodies and HEs, with freed memory remaining bound to those arenas until interpreter exit. Now it allocates memory from arenas private to the specific pointer table, and that memory is returned to the system when Perl_ptr_table_free is called. Additionally, allocation and release are both less CPU intensive.

  • A new function, Perl_magic_methcall has been added that wraps the setup needed to call a magic method like FETCH (the existing S_magic_methcall function has been renamed S_magic_methcall1).

Deprecations

The following items are now deprecated.

Perl_ptr_table_clear

Perl_ptr_table_clear is no longer part of Perl's public API. Calling it now generates a deprecation warning, and it will be removed in a future release.

Acknowledgements

Perl 5.13.1 represents thirty days of development since Perl 5.13.0 and contains 15390 lines of changes across 289 files from 34 authors and committers.

Thank you to the following for contributing to this release:

Ævar Arnfjörð Bjarmason, Arkturuz, Chris 'BinGOs' Williams, Craig A. Berry, Curtis Jewell, Dan Dascalescu, David Golden, David Mitchell, Father Chrysostomos, Gene Sullivan, gfx, Gisle Aas, H.Merijn Brand, James E Keenan, James Mastros, Jan Dubois, Jesse Vincent, Karl Williamson, Leon Brocard, Lubomir Rintel (GoodData), Nicholas Clark, Philippe Bruhat (BooK), Rafael Garcia-Suarez, Rainer Tammer, Ricardo Signes, Richard Soderberg, Robin Barker, Ruslan Zakirov, Steffen Mueller, Todd Rinaldo, Tony Cook, Vincent Pit, Zefram

Reporting Bugs

If you find what you think is a bug, you might check the articles recently posted to the comp.lang.perl.misc newsgroup and the perl bug database at http://rt.perl.org/perlbug/ . There may also be information at http://www.perl.org/ , the Perl Home Page.

If you believe you have an unreported bug, please run the perlbug program included with your release. Be sure to trim your bug down to a tiny but sufficient test case. Your bug report, along with the output of perl -V, will be sent off to perlbug@perl.org to be analysed by the Perl porting team.

If the bug you are reporting has security implications, which make it inappropriate to send to a publicly archived mailing list, then please send it to perl5-security-report@perl.org. This points to a closed subscription unarchived mailing list, which includes all the core committers, who be able to help assess the impact of issues, figure out a resolution, and help co-ordinate the release of patches to mitigate or fix the problem across all platforms on which Perl is supported. Please only use this address for security issues in the Perl core, not for modules independently distributed on CPAN.

SEE ALSO

The Changes file for an explanation of how to view exhaustive details on what changed.

The INSTALL file for how to build Perl.

The README file for general stuff.

The Artistic and Copying files for copyright information.