Fix merge issues, remove excess files - match perl-5.38.2 distok gkoehler@Commit and we'll fix fallout bluhm@Right away, please deraadt@
Patch perl CVE-2016-1238The problem relates to Perl 5 ("perl") loading modules from theincludes directory array ("@INC") in which the last element is thecurrent directory ("."). That means that,
Patch perl CVE-2016-1238The problem relates to Perl 5 ("perl") loading modules from theincludes directory array ("@INC") in which the last element is thecurrent directory ("."). That means that, when "perl" wants toload a module (during first compilation or during lazy loading ofa module in run-time), perl will look for the module in the currentdirectory at the end, since '.' is the last include directory inits array of include directories to seek. The issue is with requiringlibraries that are in "." but are not otherwise installed.The major problem with this behavior is that it unexpectedly putsa user at risk whenever they execute any Perl scripts from a directorythat is writable by other accounts on the system. For instance, ifa user is logged in as root and changes directory into /tmp or anaccount's home directory, it is possible to now run any shellcommands that are written in C, Python or Ruby without fear.The same isn't true for any shell commands that are written in Perl,since a significant proportion of Perl scripts will execute codein the current working directory whenever they are run. For example,if a user on a shared system creates the file /tmp/Pod/Perldoc/Toterm.pm,and then I log in as root, change directory to /tmp, and run "perldocperlrun", it will execute the code they have placed in the file.ok deraadt@
show more ...
Import perl-5.20.1
import perl 5.16.3 from CPAN - worked on by Andrew Fresh and myself