Patch perl CVE-2016-1238

The problem relates to Perl 5 ("perl") loading modules from the
includes directory array ("@INC") in which the last element is the
current directory (".").  That means that, when "perl" wants to
load a module (during first compilation or during lazy loading of
a module in run-time), perl will look for the module in the current
directory at the end, since '.' is the last include directory in
its array of include directories to seek. The issue is with requiring
libraries that are in "." but are not otherwise installed.

The major problem with this behavior is that it unexpectedly puts
a user at risk whenever they execute any Perl scripts from a directory
that is writable by other accounts on the system. For instance, if
a user is logged in as root and changes directory into /tmp or an
account's home directory, it is possible to now run any shell
commands that are written in C, Python or Ruby without fear.

The same isn't true for any shell commands that are written in Perl,
since a significant proportion of Perl scripts will execute code
in the current working directory whenever they are run. For example,
if a user on a shared system creates the file /tmp/Pod/Perldoc/Toterm.pm,
and then I log in as root, change directory to /tmp, and run "perldoc
perlrun", it will execute the code they have placed in the file.


ok deraadt@

12 files changed, 12 insertions, 12 deletions

diff --git a/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/BaseTo.pm b/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/BaseTo.pm
index b216d426114..b95dc20e241 100644
--- a/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/BaseTo.pm
+++ b/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/BaseTo.pm
@@ -3,7 +3,7 @@ use strict;
 use warnings;
 
 use vars qw($VERSION);
-$VERSION = '3.23';
+$VERSION = '3.23_01';
 
 use Carp                  qw(croak carp);
 use Config                qw(%Config);
diff --git a/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/GetOptsOO.pm b/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/GetOptsOO.pm
index 3f4e218a946..8de2e9baf1d 100644
--- a/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/GetOptsOO.pm
+++ b/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/GetOptsOO.pm
@@ -2,7 +2,7 @@ package Pod::Perldoc::GetOptsOO;
 use strict;
 
 use vars qw($VERSION);
-$VERSION = '3.23';
+$VERSION = '3.23_01';
 
 BEGIN { # Make a DEBUG constant ASAP
   *DEBUG = defined( &Pod::Perldoc::DEBUG )
diff --git a/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToANSI.pm b/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToANSI.pm
index f0ecbced987..3dfe4888e85 100644
--- a/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToANSI.pm
+++ b/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToANSI.pm
@@ -4,7 +4,7 @@ use warnings;
 use parent qw(Pod::Perldoc::BaseTo);
 
 use vars qw($VERSION);
-$VERSION = '3.23';
+$VERSION = '3.23_01';
 
 sub is_pageable        { 1 }
 sub write_with_binmode { 0 }
diff --git a/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToChecker.pm b/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToChecker.pm
index 8bff3381201..aa451a75781 100644
--- a/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToChecker.pm
+++ b/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToChecker.pm
@@ -4,7 +4,7 @@ use warnings;
 use vars qw(@ISA);
 
 use vars qw($VERSION);
-$VERSION = '3.23';
+$VERSION = '3.23_01';
 
 # Pick our superclass...
 #
diff --git a/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToMan.pm b/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToMan.pm
index 1080dbd93e0..bf550cf5975 100644
--- a/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToMan.pm
+++ b/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToMan.pm
@@ -5,7 +5,7 @@ use warnings;
 use parent qw(Pod::Perldoc::BaseTo);
 
 use vars qw($VERSION);
-$VERSION = '3.23';
+$VERSION = '3.23_01';
 
 use File::Spec::Functions qw(catfile);
 use Pod::Man 2.18;
diff --git a/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToNroff.pm b/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToNroff.pm
index 9777581db23..f7cc1b9eb0a 100644
--- a/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToNroff.pm
+++ b/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToNroff.pm
@@ -4,7 +4,7 @@ use warnings;
 use parent qw(Pod::Perldoc::BaseTo);
 
 use vars qw($VERSION);
-$VERSION = '3.23';
+$VERSION = '3.23_01';
 
 # This is unlike ToMan.pm in that it emits the raw nroff source!
 
diff --git a/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToPod.pm b/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToPod.pm
index 97185bbb42d..6db43bf80c4 100644
--- a/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToPod.pm
+++ b/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToPod.pm
@@ -4,7 +4,7 @@ use warnings;
 use parent qw(Pod::Perldoc::BaseTo);
 
 use vars qw($VERSION);
-$VERSION = '3.23';
+$VERSION = '3.23_01';
 
 sub is_pageable        { 1 }
 sub write_with_binmode { 0 }
diff --git a/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToRtf.pm b/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToRtf.pm
index 588405715bb..3dff305b564 100644
--- a/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToRtf.pm
+++ b/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToRtf.pm
@@ -4,7 +4,7 @@ use warnings;
 use parent qw( Pod::Simple::RTF );
 
 use vars qw($VERSION);
-$VERSION = '3.23';
+$VERSION = '3.23_01';
 
 sub is_pageable        { 0 }
 sub write_with_binmode { 0 }
diff --git a/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToTerm.pm b/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToTerm.pm
index 693b52a9059..9057bb23987 100644
--- a/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToTerm.pm
+++ b/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToTerm.pm
@@ -3,7 +3,7 @@ use strict;
 use warnings;
 
 use vars qw($VERSION);
-$VERSION = '3.23';
+$VERSION = '3.23_01';
 
 use parent qw(Pod::Perldoc::BaseTo);
 
diff --git a/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToText.pm b/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToText.pm
index 07f44cd5630..ad4950e0776 100644
--- a/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToText.pm
+++ b/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToText.pm
@@ -3,7 +3,7 @@ use strict;
 use warnings;
 
 use vars qw($VERSION);
-$VERSION = '3.23';
+$VERSION = '3.23_01';
 
 use parent qw(Pod::Perldoc::BaseTo);
 
diff --git a/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToTk.pm b/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToTk.pm
index 627289e88a1..f43772b4aa7 100644
--- a/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToTk.pm
+++ b/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToTk.pm
@@ -3,7 +3,7 @@ use strict;
 use warnings;
 
 use vars qw($VERSION);
-$VERSION = '3.23';
+$VERSION = '3.23_01';
 
 use parent qw(Pod::Perldoc::BaseTo);
 
diff --git a/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToXml.pm b/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToXml.pm
index 5c86b3ebda1..e4abcbe79c3 100644
--- a/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToXml.pm
+++ b/gnu/usr.bin/perl/cpan/Pod-Perldoc/lib/Pod/Perldoc/ToXml.pm
@@ -6,7 +6,7 @@ use vars qw($VERSION);
 use parent qw( Pod::Simple::XMLOutStream );
 
 use vars qw($VERSION);
-$VERSION = '3.23';
+$VERSION = '3.23_01';
 
 sub is_pageable        { 0 }
 sub write_with_binmode { 0 }