Security Advisories (24)
CVE-2011-2728 (2012-12-21)

The bsd_glob function in the File::Glob module for Perl before 5.14.2 allows context-dependent attackers to cause a denial of service (crash) via a glob expression with the GLOB_ALTDIRFUNC flag, which triggers an uninitialized pointer dereference.

CVE-2020-12723 (2020-06-05)

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

CVE-2020-10878 (2020-06-05)

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

CVE-2020-10543 (2020-06-05)

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

CVE-2018-6913 (2018-04-17)

Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count.

CVE-2018-18314 (2018-12-07)

Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2018-18313 (2018-12-07)

Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.

CVE-2018-18312 (2018-12-05)

Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2018-18311 (2018-12-07)

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2015-8853 (2016-05-25)

The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by "a\x80."

CVE-2013-1667 (2013-03-14)

The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key.

CVE-2010-4777 (2014-02-10)

The Perl_reg_numbered_buff_fetch function in Perl 5.10.0, 5.12.0, 5.14.0, and other versions, when running with debugging enabled, allows context-dependent attackers to cause a denial of service (assertion failure and application exit) via crafted input that is not properly handled when using certain regular expressions, as demonstrated by causing SpamAssassin and OCSInventory to crash.

CVE-2010-1158 (2010-04-20)

Integer overflow in the regular expression engine in Perl 5.8.x allows context-dependent attackers to cause a denial of service (stack consumption and application crash) by matching a crafted regular expression against a long string.

CVE-2009-3626 (2009-10-29)

Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression match.

CVE-2005-3962 (2005-12-01)

Integer overflow in the format string functionality (Perl_sv_vcatpvfn) in Perl 5.9.2 and 5.8.6 Perl allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via format string specifiers with large values, which causes an integer wrap and leads to a buffer overflow, as demonstrated using format string vulnerabilities in Perl applications.

CVE-2012-5195 (2012-12-18)

Heap-based buffer overflow in the Perl_repeatcpy function in util.c in Perl 5.12.x before 5.12.5, 5.14.x before 5.14.3, and 5.15.x before 15.15.5 allows context-dependent attackers to cause a denial of service (memory consumption and crash) or possibly execute arbitrary code via the 'x' string repeat operator.

CVE-2016-2381 (2016-04-08)

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

CVE-2013-7422 (2015-08-16)

Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression.

CVE-2011-1487 (2011-04-11)

The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.

CVE-2023-47100

In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a property name associated with a \p{...} regular expression construct is mishandled. The earliest affected version is 5.30.0.

CVE-2024-56406 (2025-04-13)

A heap buffer overflow vulnerability was discovered in Perl. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`.    $ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;'    Segmentation fault (core dumped) It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.

CVE-2023-47039 (2023-10-30)

Perl for Windows relies on the system path environment variable to find the shell (cmd.exe). When running an executable which uses Windows Perl interpreter, Perl attempts to find and execute cmd.exe within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. An attacker with limited privileges can exploit this behavior by placing cmd.exe in locations with weak permissions, such as C:\ProgramData. By doing so, when an administrator attempts to use this executable from these compromised locations, arbitrary code can be executed.

CVE-2016-1238 (2016-08-02)

(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.

CVE-2015-8608 (2017-02-07)

The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.

NAME

Sys::Syslog - Perl interface to the UNIX syslog(3) calls

VERSION

Version 0.13

SYNOPSIS

use Sys::Syslog;                          # all except setlogsock(), or:
use Sys::Syslog qw(:DEFAULT setlogsock);  # default set, plus setlogsock()
use Sys::Syslog qw(:standard :macros);    # standard functions, plus macros

setlogsock $sock_type;
openlog $ident, $logopt, $facility;       # don't forget this
syslog $priority, $format, @args;
$oldmask = setlogmask $mask_priority;
closelog;

DESCRIPTION

Sys::Syslog is an interface to the UNIX syslog(3) program. Call syslog() with a string priority and a list of printf() args just like syslog(3).

EXPORTS

Sys::Syslog exports the following Exporter tags:

  • :standard exports the standard syslog(3) functions:

    openlog closelog setlogmask syslog
  • :extended exports the Perl specific functions for syslog(3):

    setlogsock
  • :macros exports the symbols corresponding to most of your syslog(3) macros. See "CONSTANTS" for the supported constants and their meaning.

By default, Sys::Syslog exports the symbols from the :standard tag.

FUNCTIONS

openlog($ident, $logopt, $facility)

Opens the syslog. $ident is prepended to every message. $logopt contains zero or more of the words pid, ndelay, nowait. The cons option is ignored, since the failover mechanism will drop down to the console automatically if all other media fail. $facility specifies the part of the system to report about, for example LOG_USER or LOG_LOCAL0: see your syslog(3) documentation for the facilities available in your system. Facility can be given as a string or a numeric macro.

This function will croak if it can't connect to the syslog daemon.

Note that openlog() now takes three arguments, just like openlog(3).

You should use openlog() before calling syslog().

Options

  • ndelay - Open the connection immediately (normally, the connection is opened when the first message is logged).

  • nowait - Don't wait for child processes that may have been created while logging the message. (The GNU C library does not create a child process, so this option has no effect on Linux.)

  • pid - Include PID with each message.

Examples

Open the syslog with options ndelay and pid, and with facility LOCAL0:

openlog($name, "ndelay,pid", "local0");

Same thing, but this time using the macro corresponding to LOCAL0:

openlog($name, "ndelay,pid", LOG_LOCAL0);
syslog($priority, $message)
syslog($priority, $format, @args)

If $priority permits, logs $message or sprintf($format, @args) with the addition that %m in $message or $format is replaced with "$!" (the latest error message).

$priority can specify a level, or a level and a facility. Levels and facilities can be given as strings or as macros.

If you didn't use openlog() before using syslog(), syslog() will try to guess the $ident by extracting the shortest prefix of $format that ends in a ":".

Examples

syslog("info", $message);           # informational level
syslog(LOG_INFO, $message);         # informational level

syslog("info|local0", $message);        # information level, Local0 facility
syslog(LOG_INFO|LOG_LOCAL0, $message);  # information level, Local0 facility
Note

Sys::Syslog version v0.07 and older passed the $message as the formatting string to sprintf() even when no formatting arguments were provided. If the code calling syslog() might execute with older versions of this module, make sure to call the function as syslog($priority, "%s", $message) instead of syslog($priority, $message). This protects against hostile formatting sequences that might show up if $message contains tainted data.

setlogmask($mask_priority)

Sets the log mask for the current process to $mask_priority and returns the old mask. If the mask argument is 0, the current log mask is not modified. See "Levels" for the list of available levels.

Examples

Only log errors:

setlogmask(LOG_ERR);

Log critical messages, errors and warnings:

setlogmask(LOG_CRIT|LOG_ERR|LOG_WARNING);
setlogsock($sock_type)
setlogsock($sock_type, $stream_location) (added in 5.004_02)

Sets the socket type to be used for the next call to openlog() or syslog() and returns true on success, undef on failure.

A value of "unix" will connect to the UNIX domain socket (in some systems a character special device) returned by the _PATH_LOG macro (if your system defines it), or /dev/log or /dev/conslog, whatever is writable. A value of 'stream' will connect to the stream indicated by the pathname provided as the optional second parameter. (For example Solaris and IRIX require "stream" instead of "unix".) A value of "inet" will connect to an INET socket (either tcp or udp, tried in that order) returned by getservbyname(). "tcp" and "udp" can also be given as values. The value "console" will send messages directly to the console, as for the "cons" option in the logopts in openlog().

A reference to an array can also be passed as the first parameter. When this calling method is used, the array should contain a list of sock_types which are attempted in order.

The default is to try tcp, udp, unix, stream, console.

Giving an invalid value for $sock_type will croak.

closelog()

Closes the log file and return true on success.

EXAMPLES

openlog($program, 'cons,pid', 'user');
syslog('info', '%s', 'this is another test');
syslog('mail|warning', 'this is a better test: %d', time);
closelog();

syslog('debug', 'this is the last test');

setlogsock('unix');
openlog("$program $$", 'ndelay', 'user');
syslog('notice', 'fooprogram: this is really done');

setlogsock('inet');
$! = 55;
syslog('info', 'problem was %m'); # %m == $! in syslog(3)

# Log to UDP port on $remotehost instead of logging locally
setlogsock('udp');
$Sys::Syslog::host = $remotehost;
openlog($program, 'ndelay', 'user');
syslog('info', 'something happened over here');

CONSTANTS

Facilities

  • LOG_AUTH - security/authorization messages

  • LOG_AUTHPRIV - security/authorization messages (private)

  • LOG_CRON - clock daemon (cron and at)

  • LOG_DAEMON - system daemons without separate facility value

  • LOG_FTP - ftp daemon

  • LOG_KERN - kernel messages

  • LOG_LOCAL0 through LOG_LOCAL7 - reserved for local use

  • LOG_LPR - line printer subsystem

  • LOG_MAIL - mail subsystem

  • LOG_NEWS - USENET news subsystem

  • LOG_SYSLOG - messages generated internally by syslogd

  • LOG_USER (default) - generic user-level messages

  • LOG_UUCP - UUCP subsystem

Levels

  • LOG_EMERG - system is unusable

  • LOG_ALERT - action must be taken immediately

  • LOG_CRIT - critical conditions

  • LOG_ERR - error conditions

  • LOG_WARNING - warning conditions

  • LOG_NOTICE - normal, but significant, condition

  • LOG_INFO - informational message

  • LOG_DEBUG - debug-level message

DIAGNOSTICS

Invalid argument passed to setlogsock

(F) You gave setlogsock() an invalid value for $sock_type.

no connection to syslog available

(F) syslog() failed to connect to the specified socket.

stream passed to setlogsock, but %s is not writable

(W) You asked setlogsock() to use a stream socket, but the given path is not writable.

stream passed to setlogsock, but could not find any device

(W) You asked setlogsock() to use a stream socket, but didn't provide a path, and Sys::Syslog was unable to find an appropriate one.

tcp passed to setlogsock, but tcp service unavailable

(W) You asked setlogsock() to use a TCP socket, but the service is not available on the system.

syslog: expecting argument %s

(F) You forgot to give syslog() the indicated argument.

syslog: invalid level/facility: %s

(F) You specified an invalid level or facility, like LOG_KERN (which is reserved to the kernel).

syslog: too many levels given: %s

(F) You specified too many levels.

syslog: too many facilities given: %s

(F) You specified too many facilities.

syslog: level must be given

(F) You forgot to specify a level.

udp passed to setlogsock, but udp service unavailable

(W) You asked setlogsock() to use a UDP socket, but the service is not available on the system.

unix passed to setlogsock, but path not available

(W) You asked setlogsock() to use a UNIX socket, but Sys::Syslog was unable to find an appropriate an appropriate device.

SEE ALSO

syslog(3)

Syslogging with Perl, http://lexington.pm.org/meetings/022001.html

AUTHOR

Tom Christiansen <tchrist@perl.com> and Larry Wall <larry@wall.org>.

UNIX domain sockets added by Sean Robinson <robinson_s@sc.maricopa.edu> with support from Tim Bunce <Tim.Bunce@ig.co.uk> and the perl5-porters mailing list.

Dependency on syslog.ph replaced with XS code by Tom Hughes <tom@compton.nu>.

Code for constant()s regenerated by Nicholas Clark <nick@ccl4.org>.

Failover to different communication modes by Nick Williams <Nick.Williams@morganstanley.com>.

Extracted from core distribution for publishing on the CPAN by Sébastien Aperghis-Tramoni <sebastien@aperghis.net>.

BUGS

Please report any bugs or feature requests to bug-sys-syslog at rt.cpan.org, or through the web interface at http://rt.cpan.org/NoAuth/ReportBug.html?Queue=Sys-Syslog. I will be notified, and then you'll automatically be notified of progress on your bug as I make changes.

SUPPORT

You can find documentation for this module with the perldoc command.

perldoc Sys::Syslog

You can also look for information at:

LICENSE

This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.