Use perl5125delta to Audit a Perl 5.12.5 Upgrade

Three CVEs sit inside perl5125delta, which is reason enough to read it properly before waving through a Perl 5.12.5 upgrade. It is documentation, not a command: it describes differences between Perl 5.12.4 and 5.12.5, and you supply the verification.

Allow about 15 minutes. You need a shell, the perl-doc package, and permission to read the Perl installation. Every check below is read-only.

• What you will get: the interpreter identified, the historical delta read locally, and the security and compatibility points recorded without mistaking an old release note for today's runtime.

1. Establish which Perl you are checking

Find the interpreter and record its version first:

$ command -v perl
/usr/bin/perl
$ perl -e 'print "$^V\n"'
v5.38.2

Your output may differ. On this machine the installed interpreter is Perl 5.38.2, while the document concerns the older 5.12.5 release. That gap is the first checkpoint: the manpage explains what changed in that historical release, but it says nothing about whether a modern Perl shares the same bundled module versions or implementation details.

2. Confirm that the delta document is installed

Use perldoc to locate the source and man to read the rendered document:

$ perldoc -l perl5125delta
/usr/share/perl/5.38/pod/perl5125delta.pod
$ man perl5125delta

No luck with perldoc -l? Install the distribution's documentation package through your normal process. Here that package is perl-doc, version 5.38.2-3.2ubuntu0.6, which identifies the documentation bundle, not a claim that Perl 5.12.5 itself is installed.

3. Extract the security work before the smaller fixes

Read the Security section first. The 5.12.5 delta records three corrected issues:

• Encode heap overflow on certain input, CVE-2011-2939.
• File::Glob::bsd_glob memory error when unsupported GLOB_ALTDIRFUNC flags come from an external source, CVE-2011-2728.
• Heap buffer overrun involving the x string repeat operator, CVE-2012-5195.

These describe vulnerabilities that were fixed, not a safe invitation to feed hostile values to an old Perl binary. If an application still runs Perl 5.12, treat the interpreter and its bundled modules as an upgrade decision, not a place to reproduce a vulnerability. Do not copy an untrusted proof of concept into a production process.

For an audit record, capture the relevant headings without modifying the system:

$ man -P cat perl5125delta | sed -n '/^Security$/,/^Incompatible Changes$/p'

The output should contain the three security headings and end before Incompatible Changes. A pager suits a human review; the pipeline above suits attaching a plain-text check to an upgrade ticket.

4. Check the compatibility boundary

The document reports nothing intentionally incompatible with 5.12.4. That is a narrow statement about this one release delta. It does not mean an application can jump from any Perl version untested, and it does not guarantee third-party CPAN modules or operating-system libraries behave identically.

Record the interpreter's build details and the versions of modules the delta names:

$ perl -V:version -V:archname
version='5.38.2';
archname='x86_64-linux-gnu-thread-multi';
$ perl -MEncode -MFile::Glob -MModule::CoreList -e 'printf "perl=%vd Encode=%s File::Glob=%s Module::CoreList=%s\n", $^V, $Encode::VERSION, $File::Glob::VERSION, $Module::CoreList::VERSION'
perl=5.38.2 Encode=3.19 File::Glob=1.40 Module::CoreList=5.20231129

Those values are current on this machine, not the 5.12.5 notes' values. The delta says Encode moved from 2.39 to 2.39_01, File::Glob from 1.07 to 1.07_01, and Module::CoreList to 2.50_02. Treat those as historical checkpoints when examining a 5.12.5 installation, not as targets to force onto a modern system.

5. Verify representative behaviour safely

The release notes also mention fixes to charnames::viacode(0), scalar or void-context split, and the x repeat operator. These short checks use no hostile sizes and change no files:

$ perl -Mcharnames=viacode -e 'my $v = charnames::viacode(0); print defined($v) ? "$v\n" : "undef\n"'
NULL
$ perl -e 'my @x = split /,/, "a,b"; print scalar(@x), " ", join("|", @x), "\n"'
2 a|b
$ perl -e 'my $s = "abc"; print $s x 3, "\n"'
abcabcabc

On this host these run under Perl 5.38.2, so they smoke-test the installed interpreter rather than reproduce the 5.12.5 implementation. A passing modern test does not prove an old embedded or vendor Perl has received every fix.

6. Turn the reading into an upgrade decision

Compare the target runtime with the security section, then test the application's real module set and deployment environment. Include perl -V in the evidence, confirm whether the target is actually 5.12.5 or another release, and read the preceding delta documents for skipped versions. The manpage also points to Changes for exhaustive history and to perlbug for reporting a suspected core defect; neither command upgrades Perl.

Do not use sudo for these checks. Installation, interpreter replacement and service restarts are separate, potentially disruptive actions. If an upgrade changes a service, keep the old package available per your distribution's recovery policy and test the service before removing anything. There is no undo operation in perl5125delta because it only reads documentation.