Read Perl 5.14.2 Changes Without Misreading Your Installed Perl

Two security fixes hide inside perl5142delta, a page about Perl 5.14.1 to 5.14.2, not your currently running Perl.

You will finish with a reliable way to read the page, confirm which documentation package is installed, and decide which historical changes matter to an upgrade review. Allow about ten minutes. You need a shell and the perl-doc package. The examples below were checked on a machine running Perl 5.38.2 with perl-doc package version 5.38.2-3.2ubuntu0.6; your versions may differ.

1. Confirm the document and installed Perl

Start with ordinary, read-only checks. They need no sudo and change no configuration:

$ command -v perl
/usr/bin/perl
$ perl -e 'print "$^V\n"'
v5.38.2
$ dpkg-query -W -f='${Package} ${Version}\n' perl-doc
perl-doc 5.38.2-3.2ubuntu0.6

The installed interpreter is 5.38.2; this page is about the 5.14.2 release from 2011. That gap is the main trap. The delta is good for release archaeology, compatibility review and checking whether an old deployment included a fix. It says nothing about whether your current interpreter has only the fixes listed here.

2. Read the delta through the installed documentation

Ask perldoc for the exact local page:

$ perldoc perl5142delta

Opens the installed manual in your configured pager; press q to leave. For a text copy you can search without touching the source file, redirect the rendered output to a temporary file:

$ perldoc -T perl5142delta > /tmp/perl5142delta.txt
$ rg -n 'Security|Updated Modules|Bug Fixes|Known Problems' /tmp/perl5142delta.txt

The -T option asks for plain text. The redirect creates or replaces only that named file, so choose the path deliberately, and remove it afterwards if it holds anything you do not want kept. Nothing here needs elevated privileges.

3. Start with the security fixes

The 5.14.2 page records two security issues:

• File::Glob::bsd_glob() access violation. An unsupported GLOB_ALTDIRFUNC flag could cause a segmentation fault, denial of service, or possible code execution if a program accepted flags from an external source. Fixed by disabling unsupported flags and clearing unused function pointers.
• Encode heap overflow on certain inputs.

These are release notes, not safe demonstrations. Do not try to recreate either fault against a production interpreter or feed hostile input to an old Perl merely to watch it crash.

Use the installed module versions to frame an audit instead:

$ perl -MFile::Glob -MEncode -MPerlIO::scalar -e \
  'printf "File::Glob %s\nEncode %s\nPerlIO::scalar %s\n", $File::Glob::VERSION, $Encode::VERSION, $PerlIO::scalar::VERSION'
File::Glob 1.40
Encode 3.19
PerlIO::scalar 0.31

Those values are from the checked host, not universal defaults. Compare them with what the Perl distribution under review actually supplies. A modern-looking module version is useful evidence, not a substitute for checking the complete package update history and the application's own input boundaries.

4. Separate module changes from language compatibility

The release notes record these bumps: CPAN moved from 1.9600 to 1.9600_01, CPAN::Distribution from 1.9602 to 1.9602_01, Encode from 2.42 to 2.42_01, File::Glob from 1.12 to 1.13, and PerlIO::scalar from 0.11 to 0.11_01, alongside bug fixes and safer handling of configure_requires in CPAN META files.

Do not turn those historical numbers into requirements for a 5.38 installation. Identify the interpreter and distribution actually being upgraded first, then inspect its own bundled module versions:

$ perl -MCPAN -MCPAN::Distribution -MEncode -MFile::Glob -MPerlIO::scalar -e \
  'printf "CPAN %s\nCPAN::Distribution %s\nEncode %s\nFile::Glob %s\nPerlIO::scalar %s\n", $CPAN::VERSION, $CPAN::Distribution::VERSION, $Encode::VERSION, $File::Glob::VERSION, $PerlIO::scalar::VERSION'

This prints local facts only. If a module will not load, treat that as an audit finding to investigate, not proof that the 5.14.2 notes apply directly.

5. Check the bug-fix and platform sections

The bug-fix section covers edge cases in @INC filters, packing with U*, caller memory handling in the DB package, copy-on-write scalars, tied variables, restricted hashes, glob copies, and the interaction between the /aa regex modifiers and \b. Valuable if an application depends on those internals, but not a list of new syntax to enable.

Platform notes mention HP-UX PA-RISC/64 with gcc-4.x and Mac OS X 10.7 with Xcode 4. There is also a known problem: builds using PERL_GLOBAL_STRUCT were broken since 5.14.0, affecting platforms such as Symbian. Ordinary Linux on a current supported distribution? Do not let these specialised notes distract from the security and dependency sections above.

6. Turn the reading into an upgrade decision

For a real upgrade review, capture the old and new interpreter versions, package versions, enabled modules and test results. Run the application's test suite under the candidate interpreter, paying particular attention to code that parses externally supplied glob flags, decodes untrusted byte strings, loads modules through @INC, or relies on copy-on-write behaviour.

Found a suspected defect? Reduce it to a small test case and gather perl -V, as the manual advises. Keep security-sensitive input out of a public issue: the notes point to perlbug for ordinary reports and a private Perl security address for core security issues.

Nothing here needs a rollback. Every example only reads documentation or reports version information. If you created /tmp/perl5142delta.txt, remove that one temporary file after checking it, and leave the installed packages untouched.