Security Advisories (24)
CVE-2011-2728 (2012-12-21)

The bsd_glob function in the File::Glob module for Perl before 5.14.2 allows context-dependent attackers to cause a denial of service (crash) via a glob expression with the GLOB_ALTDIRFUNC flag, which triggers an uninitialized pointer dereference.

CVE-2020-12723 (2020-06-05)

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

CVE-2020-10878 (2020-06-05)

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

CVE-2020-10543 (2020-06-05)

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

CVE-2018-6913 (2018-04-17)

Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count.

CVE-2018-18314 (2018-12-07)

Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2018-18313 (2018-12-07)

Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.

CVE-2018-18312 (2018-12-05)

Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2018-18311 (2018-12-07)

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2015-8853 (2016-05-25)

The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by "a\x80."

CVE-2013-1667 (2013-03-14)

The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key.

CVE-2010-4777 (2014-02-10)

The Perl_reg_numbered_buff_fetch function in Perl 5.10.0, 5.12.0, 5.14.0, and other versions, when running with debugging enabled, allows context-dependent attackers to cause a denial of service (assertion failure and application exit) via crafted input that is not properly handled when using certain regular expressions, as demonstrated by causing SpamAssassin and OCSInventory to crash.

CVE-2010-1158 (2010-04-20)

Integer overflow in the regular expression engine in Perl 5.8.x allows context-dependent attackers to cause a denial of service (stack consumption and application crash) by matching a crafted regular expression against a long string.

CVE-2009-3626 (2009-10-29)

Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression match.

CVE-2005-3962 (2005-12-01)

Integer overflow in the format string functionality (Perl_sv_vcatpvfn) in Perl 5.9.2 and 5.8.6 Perl allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via format string specifiers with large values, which causes an integer wrap and leads to a buffer overflow, as demonstrated using format string vulnerabilities in Perl applications.

CVE-2012-5195 (2012-12-18)

Heap-based buffer overflow in the Perl_repeatcpy function in util.c in Perl 5.12.x before 5.12.5, 5.14.x before 5.14.3, and 5.15.x before 15.15.5 allows context-dependent attackers to cause a denial of service (memory consumption and crash) or possibly execute arbitrary code via the 'x' string repeat operator.

CVE-2016-2381 (2016-04-08)

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

CVE-2013-7422 (2015-08-16)

Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression.

CVE-2011-1487 (2011-04-11)

The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.

CVE-2023-47100

In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a property name associated with a \p{...} regular expression construct is mishandled. The earliest affected version is 5.30.0.

CVE-2024-56406 (2025-04-13)

A heap buffer overflow vulnerability was discovered in Perl. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`.    $ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;'    Segmentation fault (core dumped) It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.

CVE-2023-47039 (2023-10-30)

Perl for Windows relies on the system path environment variable to find the shell (cmd.exe). When running an executable which uses Windows Perl interpreter, Perl attempts to find and execute cmd.exe within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. An attacker with limited privileges can exploit this behavior by placing cmd.exe in locations with weak permissions, such as C:\ProgramData. By doing so, when an administrator attempts to use this executable from these compromised locations, arbitrary code can be executed.

CVE-2016-1238 (2016-08-02)

(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.

CVE-2015-8608 (2017-02-07)

The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.

NAME

IPC::Cmd - finding and running system commands made easy

SYNOPSIS

use IPC::Cmd qw[can_run run];

my $full_path = can_run('wget') or warn 'wget is not installed!';

### commands can be arrayrefs or strings ###
my $cmd = "$full_path -b theregister.co.uk";
my $cmd = [$full_path, '-b', 'theregister.co.uk'];

### in scalar context ###
my $buffer;
if( scalar run( command => $cmd,
                verbose => 0,
                buffer  => \$buffer )
) {
    print "fetched webpage successfully: $buffer\n";
}


### in list context ###
my( $success, $error_code, $full_buf, $stdout_buf, $stderr_buf ) =
        run( command => $cmd, verbose => 0 );

if( $success ) {
    print "this is what the command printed:\n";
    print join "", @$full_buf;
}

### check for features
print "IPC::Open3 available: "  . IPC::Cmd->can_use_ipc_open3;      
print "IPC::Run available: "    . IPC::Cmd->can_use_ipc_run;      
print "Can capture buffer: "    . IPC::Cmd->can_capture_buffer;     

### don't have IPC::Cmd be verbose, ie don't print to stdout or
### stderr when running commands -- default is '0'
$IPC::Cmd::VERBOSE = 0;

DESCRIPTION

IPC::Cmd allows you to run commands, interactively if desired, platform independent but have them still work.

The can_run function can tell you if a certain binary is installed and if so where, whereas the run function can actually execute any of the commands you give it and give you a clear return value, as well as adhere to your verbosity settings.

CLASS METHODS

$bool = IPC::Cmd->can_use_ipc_run( [VERBOSE] )

Utility function that tells you if IPC::Run is available. If the verbose flag is passed, it will print diagnostic messages if IPC::Run can not be found or loaded.

$bool = IPC::Cmd->can_use_ipc_open3( [VERBOSE] )

Utility function that tells you if IPC::Open3 is available. If the verbose flag is passed, it will print diagnostic messages if IPC::Open3 can not be found or loaded.

$bool = IPC::Cmd->can_capture_buffer

Utility function that tells you if IPC::Cmd is capable of capturing buffers in it's current configuration.

FUNCTIONS

$path = can_run( PROGRAM );

can_run takes but a single argument: the name of a binary you wish to locate. can_run works much like the unix binary which or the bash command type, which scans through your path, looking for the requested binary .

Unlike which and type, this function is platform independent and will also work on, for example, Win32.

It will return the full path to the binary you asked for if it was found, or undef if it was not.

$ok | ($ok, $err, $full_buf, $stdout_buff, $stderr_buff) = run( command => COMMAND, [verbose => BOOL, buffer => \$SCALAR] );

run takes 3 arguments:

command

This is the command to execute. It may be either a string or an array reference. This is a required argument.

See CAVEATS for remarks on how commands are parsed and their limitations.

verbose

This controls whether all output of a command should also be printed to STDOUT/STDERR or should only be trapped in buffers (NOTE: buffers require IPC::Run to be installed or your system able to work with IPC::Open3).

It will default to the global setting of $IPC::Cmd::VERBOSE, which by default is 0.

buffer

This will hold all the output of a command. It needs to be a reference to a scalar. Note that this will hold both the STDOUT and STDERR messages, and you have no way of telling which is which. If you require this distinction, run the run command in list context and inspect the individual buffers.

Of course, this requires that the underlying call supports buffers. See the note on buffers right above.

run will return a simple true or false when called in scalar context. In list context, you will be returned a list of the following items:

success

A simple boolean indicating if the command executed without errors or not.

errorcode

If the first element of the return value (success) was 0, then some error occurred. This second element is the error code the command you requested exited with, if available.

full_buffer

This is an arrayreference containing all the output the command generated. Note that buffers are only available if you have IPC::Run installed, or if your system is able to work with IPC::Open3 -- See below). This element will be undef if this is not the case.

out_buffer

This is an arrayreference containing all the output sent to STDOUT the command generated. Note that buffers are only available if you have IPC::Run installed, or if your system is able to work with IPC::Open3 -- See below). This element will be undef if this is not the case.

error_buffer

This is an arrayreference containing all the output sent to STDERR the command generated. Note that buffers are only available if you have IPC::Run installed, or if your system is able to work with IPC::Open3 -- See below). This element will be undef if this is not the case.

See the HOW IT WORKS Section below to see how IPC::Cmd decides what modules or function calls to use when issuing a command.

HOW IT WORKS

run will try to execute your command using the following logic:

  • If you have IPC::Run installed, and the variable $IPC::Cmd::USE_IPC_RUN is set to true (See the GLOBAL VARIABLES Section) use that to execute the command. You will have the full output available in buffers, interactive commands are sure to work and you are guaranteed to have your verbosity settings honored cleanly.

  • Otherwise, if the variable $IPC::Cmd::USE_IPC_OPEN3 is set to true (See the GLOBAL VARIABLES Section), try to execute the command using IPC::Open3. Buffers will be available on all platforms except Win32, interactive commands will still execute cleanly, and also your verbosity settings will be adhered to nicely;

  • Otherwise, if you have the verbose argument set to true, we fall back to a simple system() call. We cannot capture any buffers, but interactive commands will still work.

  • Otherwise we will try and temporarily redirect STDERR and STDOUT, do a system() call with your command and then re-open STDERR and STDOUT. This is the method of last resort and will still allow you to execute your commands cleanly. However, no buffers will be available.

Global Variables

The behaviour of IPC::Cmd can be altered by changing the following global variables:

$IPC::Cmd::VERBOSE

This controls whether IPC::Cmd will print any output from the commands to the screen or not. The default is 0;

$IPC::Cmd::USE_IPC_RUN

This variable controls whether IPC::Cmd will try to use IPC::Run when available and suitable. Defaults to true if you are on Win32.

$IPC::Cmd::USE_IPC_OPEN3

This variable controls whether IPC::Cmd will try to use IPC::Open3 when available and suitable. Defaults to true.

$IPC::Cmd::WARN

This variable controls whether run time warnings should be issued, like the failure to load an IPC::* module you explicitly requested.

Defaults to true. Turn this off at your own risk.

Caveats

Whitespace

When you provide a string as this argument, the string will be split on whitespace to determine the individual elements of your command. Although this will usually just Do What You Mean, it may break if you have files or commands with whitespace in them.

If you do not wish this to happen, you should provide an array reference, where all parts of your command are already separated out. Note however, if there's extra or spurious whitespace in these parts, the parser or underlying code may not interpret it correctly, and cause an error.

Example: The following code

gzip -cdf foo.tar.gz | tar -xf -

should either be passed as

"gzip -cdf foo.tar.gz | tar -xf -"

or as

['gzip', '-cdf', 'foo.tar.gz', '|', 'tar', '-xf', '-']

But take care not to pass it as, for example

['gzip -cdf foo.tar.gz', '|', 'tar -xf -']

Since this will lead to issues as described above.

IO Redirect

Currently it is too complicated to parse your command for IO Redirections. For capturing STDOUT or STDERR there is a work around however, since you can just inspect your buffers for the contents.

See Also

IPC::Run, IPC::Open3

AUTHOR

This module by Jos Boumans <kane@cpan.org>.

ACKNOWLEDGEMENTS

Thanks to James Mastros and Martijn van der Streek for their help in getting IPC::Open3 to behave nicely.

COPYRIGHT

This module is copyright (c) 2002 - 2006 Jos Boumans <kane@cpan.org>. All rights reserved.

This library is free software; you may redistribute and/or modify it under the same terms as Perl itself.