Audit a Perl 5.14.4 Upgrade with perl5144delta

Somebody asks if your box is exposed to a 2013 Perl CVE, and perl5144delta is where you find the honest answer. This turns that man page into a 10 to 15 minute, read-only review: security fixes, module changes and the one VMS-specific correction, without pretending the document upgrades Perl for you.

You need a shell and the perl-doc package. Every command below is read-only and needs no elevated privileges. Nothing here removes an older Perl, replaces a system interpreter or restarts anything.

1. Confirm which Perl and document you are reviewing

Record the interpreter and the manual page your PATH and man database actually select:

$ perl -e 'printf "%vd\n", $^V'
v5.38.2
$ man -w perl5144delta
/usr/share/man/man1/perl5144delta.1.gz
$ dpkg-query -W -f='${Package} ${Version}\n' perl-doc
perl-doc 5.38.2-3.2ubuntu0.6

The exact package version will differ on another machine. Here, the installed interpreter is Perl 5.38.2 while the manual page describes the historical 5.14.4 release, and that gap is the first thing to nail down: perl5144delta is release documentation, not proof that your running interpreter is 5.14.4.

If man -w reports no file, install the documentation package through your normal package-management process and repeat the command. Installation changes system state and may need administrative privileges, so it stays outside this read-only audit.

2. Read the release boundary before the details

Display the opening section and confirm exactly what the document compares:

$ man perl5144delta | sed -n '1,24p'
PERL5144DELTA(1)       Perl Programmers Reference Guide       PERL5144DELTA(1)

NAME
       perl5144delta - what is new for perl v5.14.4

DESCRIPTION
       This document describes differences between the 5.14.3 release and the
       5.14.4 release.

The page also says an upgrade from an earlier line, such as 5.12.0, should start with perl5140delta. Do not treat this page as a complete cross-version audit when your starting point is earlier than 5.14.3. Record the real old and new versions in your change ticket, then work through every intervening delta document that applies.

3. Extract the security fixes into your upgrade notes

Search the rendered page for the security section and its named issues:

$ man perl5144delta | grep -E 'Security|CVE-|memory leak|buffer-overflow|use-after-free|wrap-around'
       Security
   CVE-2013-1667: memory exhaustion with arbitrary hash keys
   memory leak in Encode
   [perl #111594] Socket::unpack_sockaddr_un heap-buffer-overflow
   [perl #111586] SDBM_File: fix off-by-one access to global ".dir"
   [perl #115992] PL_eval_start use-after-free
   wrap-around with IO on long strings

• CVE-2013-1667 is the one that matters most. Crafted hash keys, such as keys derived from URL arguments, could consume memory and CPU and cause denial of service. Fixed in 5.14.4.
• Encode leaked memory. Fixed alongside the CVE.
• Socket had unsafe buffer handling in unpack_sockaddr_un.
• SDBM_File had an off-by-one accessing the global .dir.
• List::Util had an off-by-two error.
• PL_eval_start had a use-after-free tied to eval.
• IO on strings larger than 2**31 bytes could wrap around.

4. Check modules and compatibility claims

Inspect the module section rather than assuming a patch release adds features:

$ man perl5144delta | sed -n '/Modules and Pragmata/,/Documentation/p'
Modules and Pragmata
   New Modules and Pragmata
       None
   Updated Modules and Pragmata
       Socket
       SDBM_File
       List::Util
       Encode has been upgraded from version 2.42_01 to version 2.42_02.
       Module::CoreList has been updated to version 2.49_06
   Removed Modules and Pragmata
       None.

The release notes say the versions of Socket, SDBM_File and List::Util did not change, despite receiving the listed fixes. Encode and Module::CoreList got explicit version bumps. Useful for a dependency audit, but no substitute for checking the package's actual files and your application's lock or deployment data.

The same page reports no intentional incompatible changes, no new deprecations, no new diagnostics, no utility changes and no configuration or compilation changes. Treat these as claims about the 5.14.4 release notes, not permission to skip your normal test suite.

5. Handle the platform-specific note

If the target is VMS, put this in the release plan: Perl 5.14.3 failed to compile there when userelocatableinc and usesitecustomize were used together. The page says this was corrected in 5.14.4 and no other platforms were affected.

For Linux, mark this item not applicable rather than treating it as a Linux build fix. The manual page also reports no new or discontinued platforms and no known problems for this release. Those statements narrow the scope of your review; they do not verify that your local compiler, operating system or packaging pipeline can build Perl.

6. Preserve the audit trail

Save the rendered output and the package version with your change record if your process needs evidence:

$ man perl5144delta > /tmp/perl5144delta-review.txt
$ sha256sum /tmp/perl5144delta-review.txt
$ wc -l /tmp/perl5144delta-review.txt
105 /tmp/perl5144delta-review.txt

The line count is an example from this installed manual and may change with formatter or package revisions. The hash is what actually helps a later comparison. The temporary file is safe to remove once the record is stored:

$ rm /tmp/perl5144delta-review.txt