Patch perl CVE-2016-1238

The problem relates to Perl 5 ("perl") loading modules from the
includes directory array ("@INC") in which the last element is the
current directory (".").  That means that, when "perl" wants to
load a module (during first compilation or during lazy loading of
a module in run-time), perl will look for the module in the current
directory at the end, since '.' is the last include directory in
its array of include directories to seek. The issue is with requiring
libraries that are in "." but are not otherwise installed.

The major problem with this behavior is that it unexpectedly puts
a user at risk whenever they execute any Perl scripts from a directory
that is writable by other accounts on the system. For instance, if
a user is logged in as root and changes directory into /tmp or an
account's home directory, it is possible to now run any shell
commands that are written in C, Python or Ruby without fear.

The same isn't true for any shell commands that are written in Perl,
since a significant proportion of Perl scripts will execute code
in the current working directory whenever they are run. For example,
if a user on a shared system creates the file /tmp/Pod/Perldoc/Toterm.pm,
and then I log in as root, change directory to /tmp, and run "perldoc
perlrun", it will execute the code they have placed in the file.


ok deraadt@

14 files changed, 15 insertions, 15 deletions

diff --git a/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Adapter/Bzip2.pm b/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Adapter/Bzip2.pm
index c77e06b29b7..7f2f32b5299 100644
--- a/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Adapter/Bzip2.pm
+++ b/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Adapter/Bzip2.pm
@@ -9,7 +9,7 @@ use IO::Compress::Base::Common  2.064 qw(:Status);
 use Compress::Raw::Bzip2  2.064 ;
 
 our ($VERSION);
-$VERSION = '2.064';
+$VERSION = '2.064_01';
 
 sub mkCompObject
 {
diff --git a/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Adapter/Deflate.pm b/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Adapter/Deflate.pm
index c8fdf2a2c7d..32e25a0a11a 100644
--- a/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Adapter/Deflate.pm
+++ b/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Adapter/Deflate.pm
@@ -10,7 +10,7 @@ use Compress::Raw::Zlib  2.064 qw( !crc32 !adler32 ) ;
 require Exporter;                                     
 our ($VERSION, @ISA, @EXPORT_OK, %EXPORT_TAGS, @EXPORT, %DEFLATE_CONSTANTS);
 
-$VERSION = '2.064';
+$VERSION = '2.064_01';
 @ISA = qw(Exporter);
 @EXPORT_OK = @Compress::Raw::Zlib::DEFLATE_CONSTANTS;
 %EXPORT_TAGS = %Compress::Raw::Zlib::DEFLATE_CONSTANTS;
diff --git a/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Adapter/Identity.pm b/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Adapter/Identity.pm
index b612de0a22b..9f233e87810 100644
--- a/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Adapter/Identity.pm
+++ b/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Adapter/Identity.pm
@@ -7,7 +7,7 @@ use bytes;
 use IO::Compress::Base::Common  2.064 qw(:Status);
 our ($VERSION);
 
-$VERSION = '2.064';
+$VERSION = '2.064_01';
 
 sub mkCompObject
 {
diff --git a/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Base.pm b/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Base.pm
index 6dc791776ab..2653431536d 100644
--- a/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Base.pm
+++ b/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Base.pm
@@ -20,7 +20,7 @@ use Symbol();
 our (@ISA, $VERSION);
 @ISA    = qw(Exporter IO::File);
 
-$VERSION = '2.064';
+$VERSION = '2.064_01';
 
 #Can't locate object method "SWASHNEW" via package "utf8" (perhaps you forgot to load "utf8"?) at .../ext/Compress-Zlib/Gzip/blib/lib/Compress/Zlib/Common.pm line 16.
 
diff --git a/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Base/Common.pm b/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Base/Common.pm
index aa61c792c86..7559ab4eb14 100644
--- a/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Base/Common.pm
+++ b/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Base/Common.pm
@@ -11,7 +11,7 @@ use File::GlobMapper;
 require Exporter;
 our ($VERSION, @ISA, @EXPORT, %EXPORT_TAGS, $HAS_ENCODE);
 @ISA = qw(Exporter);
-$VERSION = '2.064';
+$VERSION = '2.064_01';
 
 @EXPORT = qw( isaFilehandle isaFilename isaScalar
               whatIsInput whatIsOutput 
@@ -464,7 +464,7 @@ sub createSelfTiedObject
 #
 #require Exporter;
 #our ($VERSION, @ISA, @EXPORT);
-#$VERSION = '2.000_08';
+#$VERSION = '2.000_09';
 #@ISA = qw(Exporter);
 
 $EXPORT_TAGS{Parse} = [qw( ParseParameters 
diff --git a/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Bzip2.pm b/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Bzip2.pm
index fc62b4f4f95..b3a7f0117f4 100644
--- a/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Bzip2.pm
+++ b/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Bzip2.pm
@@ -14,7 +14,7 @@ use IO::Compress::Adapter::Bzip2 2.064 ;
 
 our ($VERSION, @ISA, @EXPORT_OK, %EXPORT_TAGS, $Bzip2Error);
 
-$VERSION = '2.064';
+$VERSION = '2.064_01';
 $Bzip2Error = '';
 
 @ISA    = qw(Exporter IO::Compress::Base);
diff --git a/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Deflate.pm b/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Deflate.pm
index d8848d7f696..0e411dc3950 100644
--- a/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Deflate.pm
+++ b/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Deflate.pm
@@ -17,7 +17,7 @@ use IO::Compress::Base::Common  2.064 qw();
 
 our ($VERSION, @ISA, @EXPORT_OK, %EXPORT_TAGS, %DEFLATE_CONSTANTS, $DeflateError);
 
-$VERSION = '2.064';
+$VERSION = '2.064_01';
 $DeflateError = '';
 
 @ISA    = qw(Exporter IO::Compress::RawDeflate);
diff --git a/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Gzip.pm b/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Gzip.pm
index febeea6ca91..c43b950e0da 100644
--- a/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Gzip.pm
+++ b/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Gzip.pm
@@ -25,7 +25,7 @@ BEGIN
 
 our ($VERSION, @ISA, @EXPORT_OK, %EXPORT_TAGS, %DEFLATE_CONSTANTS, $GzipError);
 
-$VERSION = '2.064';
+$VERSION = '2.064_01';
 $GzipError = '' ;
 
 @ISA    = qw(Exporter IO::Compress::RawDeflate);
diff --git a/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Gzip/Constants.pm b/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Gzip/Constants.pm
index f6c15c72c9a..64d108d4113 100644
--- a/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Gzip/Constants.pm
+++ b/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Gzip/Constants.pm
@@ -9,7 +9,7 @@ require Exporter;
 our ($VERSION, @ISA, @EXPORT, %GZIP_OS_Names);
 our ($GZIP_FNAME_INVALID_CHAR_RE, $GZIP_FCOMMENT_INVALID_CHAR_RE);
 
-$VERSION = '2.064';
+$VERSION = '2.064_01';
 
 @ISA = qw(Exporter);
 
diff --git a/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/RawDeflate.pm b/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/RawDeflate.pm
index 38f7f7dab0e..67a6efa1d4c 100644
--- a/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/RawDeflate.pm
+++ b/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/RawDeflate.pm
@@ -14,7 +14,7 @@ require Exporter ;
 
 our ($VERSION, @ISA, @EXPORT_OK, %DEFLATE_CONSTANTS, %EXPORT_TAGS, $RawDeflateError);
 
-$VERSION = '2.064';
+$VERSION = '2.064_01';
 $RawDeflateError = '';
 
 @ISA = qw(Exporter IO::Compress::Base);
diff --git a/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Zip.pm b/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Zip.pm
index a8645b346af..f6e50cb270e 100644
--- a/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Zip.pm
+++ b/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Zip.pm
@@ -36,7 +36,7 @@ require Exporter ;
 
 our ($VERSION, @ISA, @EXPORT_OK, %EXPORT_TAGS, %DEFLATE_CONSTANTS, $ZipError);
 
-$VERSION = '2.064';
+$VERSION = '2.064_01';
 $ZipError = '';
 
 @ISA = qw(Exporter IO::Compress::RawDeflate);
diff --git a/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Zip/Constants.pm b/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Zip/Constants.pm
index 02609b940a4..c17ff674e8c 100644
--- a/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Zip/Constants.pm
+++ b/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Zip/Constants.pm
@@ -7,7 +7,7 @@ require Exporter;
 
 our ($VERSION, @ISA, @EXPORT, %ZIP_CM_MIN_VERSIONS);
 
-$VERSION = '2.064';
+$VERSION = '2.064_01';
 
 @ISA = qw(Exporter);
 
diff --git a/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Zlib/Constants.pm b/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Zlib/Constants.pm
index 7dd1622dfb2..c508b920413 100644
--- a/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Zlib/Constants.pm
+++ b/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Zlib/Constants.pm
@@ -9,7 +9,7 @@ require Exporter;
 
 our ($VERSION, @ISA, @EXPORT);
 
-$VERSION = '2.064';
+$VERSION = '2.064_01';
 
 @ISA = qw(Exporter);
 
diff --git a/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Zlib/Extra.pm b/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Zlib/Extra.pm
index ca92b5f9bd9..d9d35061344 100644
--- a/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Zlib/Extra.pm
+++ b/gnu/usr.bin/perl/cpan/IO-Compress/lib/IO/Compress/Zlib/Extra.pm
@@ -8,7 +8,7 @@ use bytes;
 
 our ($VERSION, @ISA, @EXPORT_OK, %EXPORT_TAGS);
 
-$VERSION = '2.064';
+$VERSION = '2.064_01';
 
 use IO::Compress::Gzip::Constants 2.064 ;