Security Advisories (24)
CVE-2011-2728 (2012-12-21)

The bsd_glob function in the File::Glob module for Perl before 5.14.2 allows context-dependent attackers to cause a denial of service (crash) via a glob expression with the GLOB_ALTDIRFUNC flag, which triggers an uninitialized pointer dereference.

CVE-2020-12723 (2020-06-05)

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

CVE-2020-10878 (2020-06-05)

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

CVE-2020-10543 (2020-06-05)

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

CVE-2018-6913 (2018-04-17)

Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count.

CVE-2018-18314 (2018-12-07)

Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2018-18313 (2018-12-07)

Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.

CVE-2018-18312 (2018-12-05)

Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2018-18311 (2018-12-07)

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2015-8853 (2016-05-25)

The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by "a\x80."

CVE-2013-1667 (2013-03-14)

The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key.

CVE-2010-4777 (2014-02-10)

The Perl_reg_numbered_buff_fetch function in Perl 5.10.0, 5.12.0, 5.14.0, and other versions, when running with debugging enabled, allows context-dependent attackers to cause a denial of service (assertion failure and application exit) via crafted input that is not properly handled when using certain regular expressions, as demonstrated by causing SpamAssassin and OCSInventory to crash.

CVE-2010-1158 (2010-04-20)

Integer overflow in the regular expression engine in Perl 5.8.x allows context-dependent attackers to cause a denial of service (stack consumption and application crash) by matching a crafted regular expression against a long string.

CVE-2009-3626 (2009-10-29)

Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression match.

CVE-2005-3962 (2005-12-01)

Integer overflow in the format string functionality (Perl_sv_vcatpvfn) in Perl 5.9.2 and 5.8.6 Perl allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via format string specifiers with large values, which causes an integer wrap and leads to a buffer overflow, as demonstrated using format string vulnerabilities in Perl applications.

CVE-2012-5195 (2012-12-18)

Heap-based buffer overflow in the Perl_repeatcpy function in util.c in Perl 5.12.x before 5.12.5, 5.14.x before 5.14.3, and 5.15.x before 15.15.5 allows context-dependent attackers to cause a denial of service (memory consumption and crash) or possibly execute arbitrary code via the 'x' string repeat operator.

CVE-2016-2381 (2016-04-08)

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

CVE-2013-7422 (2015-08-16)

Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression.

CVE-2011-1487 (2011-04-11)

The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.

CVE-2023-47100

In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a property name associated with a \p{...} regular expression construct is mishandled. The earliest affected version is 5.30.0.

CVE-2024-56406 (2025-04-13)

A heap buffer overflow vulnerability was discovered in Perl. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`.    $ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;'    Segmentation fault (core dumped) It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.

CVE-2023-47039 (2023-10-30)

Perl for Windows relies on the system path environment variable to find the shell (cmd.exe). When running an executable which uses Windows Perl interpreter, Perl attempts to find and execute cmd.exe within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. An attacker with limited privileges can exploit this behavior by placing cmd.exe in locations with weak permissions, such as C:\ProgramData. By doing so, when an administrator attempts to use this executable from these compromised locations, arbitrary code can be executed.

CVE-2016-1238 (2016-08-02)

(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.

CVE-2015-8608 (2017-02-07)

The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.

NAME

ExtUtils::Constant - generate XS code to import C header constants

SYNOPSIS

use ExtUtils::Constant qw (WriteConstants);
WriteConstants(
    NAME => 'Foo',
    NAMES => [qw(FOO BAR BAZ)],
);
# Generates wrapper code to make the values of the constants FOO BAR BAZ
#  available to perl

DESCRIPTION

ExtUtils::Constant facilitates generating C and XS wrapper code to allow perl modules to AUTOLOAD constants defined in C library header files. It is principally used by the h2xs utility, on which this code is based. It doesn't contain the routines to scan header files to extract these constants.

USAGE

Generally one only needs to call the WriteConstants function, and then

#include "const-c.inc"

in the C section of Foo.xs

INCLUDE const-xs.inc

in the XS section of Foo.xs.

For greater flexibility use constant_types(), C_constant and XS_constant, with which WriteConstants is implemented.

Currently this module understands the following types. h2xs may only know a subset. The sizes of the numeric types are chosen by the Configure script at compile time.

IV

signed integer, at least 32 bits.

UV

unsigned integer, the same size as IV

NV

floating point type, probably double, possibly long double

PV

NUL terminated string, length will be determined with strlen

PVN

A fixed length thing, given as a [pointer, length] pair. If you know the length of a string at compile time you may use this instead of PV

SV

A mortal SV.

YES

Truth. (PL_sv_yes) The value is not needed (and ignored).

NO

Defined Falsehood. (PL_sv_no) The value is not needed (and ignored).

UNDEF

undef. The value of the macro is not needed.

FUNCTIONS

C_stringify NAME

A function which returns a 7 bit ASCII correctly \ escaped version of the string passed suitable for C's "" or ''. It will die if passed Unicode characters.

perl_stringify NAME

A function which returns a 7 bit ASCII correctly \ escaped version of the string passed suitable for a perl "" string.

constant_types

A function returning a single scalar with #define definitions for the constants used internally between the generated C and XS functions.

memEQ_clause NAME, CHECKED_AT, INDENT

A function to return a suitable C if statement to check whether NAME is equal to the C variable name. If CHECKED_AT is defined, then it is used to avoid memEQ for short names, or to generate a comment to highlight the position of the character in the switch statement.

If CHECKED_AT is a reference to a scalar, then instead it gives the characters pre-checked at the beginning, (and the number of chars by which the C variable name has been advanced. These need to be chopped from the front of NAME).

assign INDENT, TYPE, PRE, POST, VALUE...

A function to return a suitable assignment clause. If TYPE is aggregate (eg PVN expects both pointer and length) then there should be multiple VALUEs for the components. PRE and POST if defined give snippets of C code to proceed and follow the assignment. PRE will be at the start of a block, so variables may be defined in it.

return_clause

return_clause ITEM, INDENT

A function to return a suitable #ifdef clause. ITEM is a hashref (as passed to C_constant and match_clause. INDENT is the number of spaces to indent, defaulting to 6.

XXX document me

switch_clause INDENT, NAMELEN, ITEMHASH, ITEM...

An internal function to generate a suitable switch clause, called by C_constant ITEMs are in the hash ref format as given in the description of C_constant, and must all have the names of the same length, given by NAMELEN (This is not checked). ITEMHASH is a reference to a hash, keyed by name, values being the hashrefs in the ITEM list. (No parameters are modified, and there can be keys in the ITEMHASH that are not in the list of ITEMs without causing problems).

params WHAT

An internal function. WHAT should be a hashref of types the constant function will return. params returns a hashref keyed IV NV PV SV to show which combination of pointers will be needed in the C argument list.

dump_names

dump_names DEFAULT_TYPE, TYPES, INDENT, OPTIONS, ITEM...

An internal function to generate the embedded perl code that will regenerate the constant subroutines. DEFAULT_TYPE, TYPES and ITEMs are the same as for C_constant. INDENT is treated as number of spaces to indent by. OPTIONS is a hashref of options. Currently only declare_types is recognised. If the value is true a $types is always declared in the perl code generated, if defined and false never declared, and if undefined $types is only declared if the values in TYPES as passed in cannot be inferred from DEFAULT_TYPES and the ITEMs.

dogfood

dogfood PACKAGE, SUBNAME, DEFAULT_TYPE, TYPES, INDENT, BREAKOUT, ITEM...

An internal function to generate the embedded perl code that will regenerate the constant subroutines. Parameters are the same as for C_constant.

C_constant

C_constant PACKAGE, SUBNAME, DEFAULT_TYPE, TYPES, INDENT, BREAKOUT, ITEM...

A function that returns a list of C subroutine definitions that return the value and type of constants when passed the name by the XS wrapper. ITEM... gives a list of constant names. Each can either be a string, which is taken as a C macro name, or a reference to a hash with the following keys

name

The name of the constant, as seen by the perl code.

type

The type of the constant (IV, NV etc)

value

A C expression for the value of the constant, or a list of C expressions if the type is aggregate. This defaults to the name if not given.

macro

The C pre-processor macro to use in the #ifdef. This defaults to the name, and is mainly used if value is an enum. If a reference an array is passed then the first element is used in place of the #ifdef line, and the second element in place of the #endif. This allows pre-processor constructions such as

#if defined (foo)
#if !defined (bar)
...
#endif
#endif

to be used to determine if a constant is to be defined.

A "macro" 1 signals that the constant is always defined, so the #if/#endif test is omitted.

default

Default value to use (instead of croaking with "your vendor has not defined...") to return if the macro isn't defined. Specify a reference to an array with type followed by value(s).

pre

C code to use before the assignment of the value of the constant. This allows you to use temporary variables to extract a value from part of a struct and return this as value. This C code is places at the start of a block, so you can declare variables in it.

post

C code to place between the assignment of value (to a temporary) and the return from the function. This allows you to clear up anything in pre. Rarely needed.

def_pre =item def_post

Equivalents of pre and post for the default value.

utf8

Generated internally. Is zero or undefined if name is 7 bit ASCII, "no" if the name is 8 bit (and so should only match if SvUTF8() is false), "yes" if the name is utf8 encoded.

The internals automatically clone any name with characters 128-255 but none 256+ (ie one that could be either in bytes or utf8) into a second entry which is utf8 encoded.

PACKAGE is the name of the package, and is only used in comments inside the generated C code.

The next 5 arguments can safely be given as undef, and are mainly used for recursion. SUBNAME defaults to constant if undefined.

DEFAULT_TYPE is the type returned by ITEMs that don't specify their type. In turn it defaults to IV. TYPES should be given either as a comma separated list of types that the C subroutine constant will generate or as a reference to a hash. DEFAULT_TYPE will be added to the list if not present, as will any types given in the list of ITEMs. The resultant list should be the same list of types that XS_constant is given. [Otherwise XS_constant and C_constant may differ in the number of parameters to the constant function. INDENT is currently unused and ignored. In future it may be used to pass in information used to change the C indentation style used.] The best way to maintain consistency is to pass in a hash reference and let this function update it.

BREAKOUT governs when child functions of SUBNAME are generated. If there are BREAKOUT or more ITEMs with the same length of name, then the code to switch between them is placed into a function named SUBNAME_LEN, for example constant_5 for names 5 characters long. The default BREAKOUT is 3. A single ITEM is always inlined.

XS_constant PACKAGE, TYPES, SUBNAME, C_SUBNAME

A function to generate the XS code to implement the perl subroutine PACKAGE::constant used by PACKAGE::AUTOLOAD to load constants. This XS code is a wrapper around a C subroutine usually generated by C_constant, and usually named constant.

TYPES should be given either as a comma separated list of types that the C subroutine constant will generate or as a reference to a hash. It should be the same list of types as C_constant was given. [Otherwise XS_constant and C_constant may have different ideas about the number of parameters passed to the C function constant]

You can call the perl visible subroutine something other than constant if you give the parameter SUBNAME. The C subroutine it calls defaults to the name of the perl visible subroutine, unless you give the parameter C_SUBNAME.

autoload PACKAGE, VERSION, AUTOLOADER

A function to generate the AUTOLOAD subroutine for the module PACKAGE VERSION is the perl version the code should be backwards compatible with. It defaults to the version of perl running the subroutine. If AUTOLOADER is true, the AUTOLOAD subroutine falls back on AutoLoader::AUTOLOAD for all names that the constant() routine doesn't recognise.

WriteMakefileSnippet

WriteMakefileSnippet ATTRIBUTE => VALUE [, ...]

A function to generate perl code for Makefile.PL that will regenerate the constant subroutines. Parameters are named as passed to WriteConstants, with the addition of INDENT to specify the number of leading spaces (default 2).

Currently only INDENT, NAME, DEFAULT_TYPE, NAMES, C_FILE and XS_FILE are recognised.

WriteConstants ATTRIBUTE => VALUE [, ...]

Writes a file of C code and a file of XS code which you should #include and INCLUDE in the C and XS sections respectively of your module's XS code. You probably want to do this in your Makefile.PL, so that you can easily edit the list of constants without touching the rest of your module. The attributes supported are

NAME

Name of the module. This must be specified

DEFAULT_TYPE

The default type for the constants. If not specified IV is assumed.

BREAKOUT_AT

The names of the constants are grouped by length. Generate child subroutines for each group with this number or more names in.

NAMES

An array of constants' names, either scalars containing names, or hashrefs as detailed in "C_constant".

C_FILE

The name of the file to write containing the C code. The default is const-c.inc. The - in the name ensures that the file can't be mistaken for anything related to a legitimate perl package name, and not naming the file .c avoids having to override Makefile.PL's .xs to .c rules.

XS_FILE

The name of the file to write containing the XS code. The default is const-xs.inc.

SUBNAME

The perl visible name of the XS subroutine generated which will return the constants. The default is constant.

C_SUBNAME

The name of the C subroutine generated which will return the constants. The default is SUBNAME. Child subroutines have _ and the name length appended, so constants with 10 character names would be in constant_10 with the default XS_SUBNAME.

AUTHOR

Nicholas Clark <nick@ccl4.org> based on the code in h2xs by Larry Wall and others