Check Perl 5.36.2 Against Its Security Fixes

Two CVEs live in the Perl 5.36.2 release notes, and perl5362delta alone will not tell you if you are exposed. This guide gives you a quick, reproducible way to read the installed notes and check for yourself: a heap buffer overflow in crafted regular expressions, and a Windows search-path problem involving cmd.exe.

Allow about ten minutes. You need a shell and Perl's documentation package. Every command below is read-only, needs no elevated privileges, and only inspects documentation and reports versions; nothing here upgrades Perl, edits configuration or restarts a service.

1. Confirm which Perl is in use

Start with the interpreter your shell will actually find. This avoids a common trap: checking one Perl installation, then running the script with a different one from another path, virtual environment or service account.

$ command -v perl
/usr/bin/perl
$ perl -V:version
version='5.38.2';
$ perl -e 'printf "running Perl %vd\n", $^V'
running Perl 5.38.2

The path and version are machine-specific, so the useful checkpoint is your final version line, not the example value. Keep the check in the same shell, container or service environment as the application you are assessing.

2. Check that the delta document is installed

perl5362delta is a documentation page, not a program to execute. perldoc -l prints the file that supplies it:

$ perldoc -l perl5362delta
/usr/share/perl/5.38/pod/perl5362delta.pod

Page not found? Check the package that supplies Perl documentation through your normal package manager, perl-doc on this host, version 5.38.2-3.2ubuntu0.6. Do not infer the interpreter version from the documentation package alone: run the version check in step 1 too.

3. Read the documented release boundary

Open the page through the normal manual interface:

$ man perl5362delta

The page covers differences between Perl 5.36.1 and 5.36.2. Starting from 5.36.0? It explicitly directs you to read perl5361delta first, a scope boundary, not a suggestion you can skip intermediate release notes on a longer upgrade path.

For a short, searchable view of the security section that does not alter the manual:

$ man perl5362delta | col -b | sed -n '/^Security$/,/^Acknowledgements$/p'
Security
       This release fixes the following security issues.
   CVE-2023-47038 - Write past buffer end via illegal user-defined Unicode
       property
   CVE-2023-47039 - Perl for Windows binary hijacking vulnerability

Exact wrapping can vary with the terminal and manual renderer. The checkpoint is that both CVE headings show up; if your output differs, check the full page rather than treating a truncated pipeline as proof a section is missing.

4. Understand the first security fix

CVE-2023-47038 concerns a crafted regular expression compiled by Perl 5.30.0 through 5.38.0: a one-byte, attacker-controlled write past the end of a heap-allocated buffer, reached through an illegal user-defined Unicode property.

This is a version-range finding, not a claim every regular expression is unsafe. It matters when an application compiles expressions influenced by untrusted input, and a read-only version check cannot prove an application is exploitable either way. The delta page does not replace reviewing how that application actually builds and compiles patterns.

5. Understand the Windows-only fix

CVE-2023-47039 is a Perl for Windows binary hijacking issue: Windows Perl searches for cmd.exe using the system path but initially looks in the current working directory. An attacker who can drop a malicious cmd.exe in a weakly protected location could get arbitrary code run when an administrator launches a Windows Perl executable from a compromised location.

This path-search behaviour is not a Linux finding, but it still belongs in an upgrade review when the same Perl code or tooling also runs on Windows. Do not copy a Linux conclusion across platforms: record the operating system alongside the Perl version and assess Windows launch locations separately.

On a Linux host, the useful result is narrower: this page still documents the release, but the Windows-specific CVE is not a Linux path-search finding. That distinction stops an accurate advisory turning into an inaccurate local diagnosis.

6. Recheck after an approved update

Updating Perl can affect several interpreters at once, so verify the actual executable again afterwards. Run as the same account and from the same environment as the application:

$ command -v perl
$ perl -V:version
$ perl -e 'printf "running Perl %vd\n", $^V'
running Perl 5.36.2

That version is only illustrative: a later vendor-supported release may be preferable, and the manual page does not define a universal safe version for every distribution. What matters is that your recorded interpreter is no longer in the vulnerable range, or that the owner has documented why a compensating control and an upgrade plan are acceptable instead.