1=encoding utf8 2 3=head1 NAME 4 5perl5343delta - what is new for perl v5.34.3 6 7=head1 DESCRIPTION 8 9This document describes differences between the 5.34.1 release and the 5.34.3 10release. B<Please note:> This document ignores Perl 5.34.2, a broken release 11which existed for a couple of days only. 12 13If you are upgrading from an earlier release such as 5.34.0, first read 14L<perl5341delta>, which describes differences between 5.34.0 and 5.34.1. 15 16=head1 Security 17 18This release fixes the following security issues. 19 20=head2 CVE-2023-47038 - Write past buffer end via illegal user-defined Unicode property 21 22This vulnerability was reported directly to the Perl security team by 23Nathan Mills C<the.true.nathan.mills@gmail.com>. 24 25A crafted regular expression when compiled by perl 5.30.0 through 265.38.0 can cause a one-byte attacker controlled buffer overflow in a 27heap allocated buffer. 28 29=head2 CVE-2023-47039 - Perl for Windows binary hijacking vulnerability 30 31This vulnerability was reported to the Intel Product Security Incident 32Response Team (PSIRT) by GitHub user ycdxsb 33L<https://github.com/ycdxsb/WindowsPrivilegeEscalation>. PSIRT then 34reported it to the Perl security team. 35 36Perl for Windows relies on the system path environment variable to 37find the shell (C<cmd.exe>). When running an executable which uses 38Windows Perl interpreter, Perl attempts to find and execute C<cmd.exe> 39within the operating system. However, due to path search order issues, 40Perl initially looks for cmd.exe in the current working directory. 41 42An attacker with limited privileges can exploit this behavior by 43placing C<cmd.exe> in locations with weak permissions, such as 44C<C:\ProgramData>. By doing so, when an administrator attempts to use 45this executable from these compromised locations, arbitrary code can 46be executed. 47 48=head1 Acknowledgements 49 50Perl 5.34.3 represents approximately 1 month of development since Perl 515.34.1 and contains approximately 3,700 lines of changes across 40 files 52from 4 authors. 53 54Excluding auto-generated files, documentation and release tools, there were 55approximately 2,800 lines of changes to 9 .pm, .t, .c and .h files. 56 57Perl continues to flourish into its fourth decade thanks to a vibrant 58community of users and developers. The following people are known to have 59contributed the improvements that became Perl 5.34.3: 60 61Karl Williamson, Paul Evans, Steve Hay, Tony Cook. 62 63The list above is almost certainly incomplete as it is automatically 64generated from version control history. In particular, it does not include 65the names of the (very much appreciated) contributors who reported issues to 66the Perl bug tracker. 67 68Many of the changes included in this version originated in the CPAN modules 69included in Perl's core. We're grateful to the entire CPAN community for 70helping Perl to flourish. 71 72For a more complete list of all of Perl's historical contributors, please 73see the F<AUTHORS> file in the Perl source distribution. 74 75=head1 Reporting Bugs 76 77If you find what you think is a bug, you might check the perl bug database 78at L<https://github.com/Perl/perl5/issues>. There may also be information at 79L<http://www.perl.org/>, the Perl Home Page. 80 81If you believe you have an unreported bug, please open an issue at 82L<https://github.com/Perl/perl5/issues>. Be sure to trim your bug down to a 83tiny but sufficient test case. 84 85If the bug you are reporting has security implications which make it 86inappropriate to send to a public issue tracker, then see 87L<perlsec/SECURITY VULNERABILITY CONTACT INFORMATION> 88for details of how to report the issue. 89 90=head1 Give Thanks 91 92If you wish to thank the Perl 5 Porters for the work we had done in Perl 5, 93you can do so by running the C<perlthanks> program: 94 95 perlthanks 96 97This will send an email to the Perl 5 Porters list with your show of thanks. 98 99=head1 SEE ALSO 100 101The F<Changes> file for an explanation of how to view exhaustive details on 102what changed. 103 104The F<INSTALL> file for how to build Perl. 105 106The F<README> file for general stuff. 107 108The F<Artistic> and F<Copying> files for copyright information. 109 110=cut 111