Security Advisories (1)
CVE-2025-40909 (2025-05-30)

Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6

NAME

ExtUtils::Command::MM - Commands for the MM's to use in Makefiles

SYNOPSIS

perl "-MExtUtils::Command::MM" -e "function" "--" arguments...

DESCRIPTION

FOR INTERNAL USE ONLY! The interface is not stable.

ExtUtils::Command::MM encapsulates code which would otherwise have to be done with large "one" liners.

Any $(FOO) used in the examples are make variables, not Perl.

test_harness
test_harness($verbose, @test_libs);

Runs the tests on @ARGV via Test::Harness passing through the $verbose flag. Any @test_libs will be unshifted onto the test's @INC.

@test_libs are run in alphabetical order.

pod2man
pod2man( '--option=value',
         $podfile1 => $manpage1,
         $podfile2 => $manpage2,
         ...
       );

# or args on @ARGV

pod2man() is a function performing most of the duties of the pod2man program. Its arguments are exactly the same as pod2man as of 5.8.0 with the addition of:

--perm_rw   octal permission to set the resulting manpage to

And the removal of:

--verbose/-v
--help/-h

If no arguments are given to pod2man it will read from @ARGV.

If Pod::Man is unavailable, this function will warn and return undef.

warn_if_old_packlist
perl "-MExtUtils::Command::MM" -e warn_if_old_packlist <somefile>

Displays a warning that an old packlist file was found. Reads the filename from @ARGV.

perllocal_install
perl "-MExtUtils::Command::MM" -e perllocal_install
    <type> <module name> <key> <value> ...

# VMS only, key|value pairs come on STDIN
perl "-MExtUtils::Command::MM" -e perllocal_install
    <type> <module name> < <key>|<value> ...

Prints a fragment of POD suitable for appending to perllocal.pod. Arguments are read from @ARGV.

'type' is the type of what you're installing. Usually 'Module'.

'module name' is simply the name of your module. (Foo::Bar)

Key/value pairs are extra information about the module. Fields include:

installed into      which directory your module was out into
LINKTYPE            dynamic or static linking
VERSION             module version number
EXE_FILES           any executables installed in a space separated
                    list
uninstall
perl "-MExtUtils::Command::MM" -e uninstall <packlist>

A wrapper around ExtUtils::Install::uninstall(). Warns that uninstallation is deprecated and doesn't actually perform the uninstallation.

test_s
perl "-MExtUtils::Command::MM" -e test_s <file>

Tests if a file exists and is not empty (size > 0). Exits with 0 if it does, 1 if it does not.

cp_nonempty
perl "-MExtUtils::Command::MM" -e cp_nonempty <srcfile> <dstfile> <perm>

Tests if the source file exists and is not empty (size > 0). If it is not empty it copies it to the given destination with the given permissions.