That will deadlock. If either the STDOUT or the STDERR pipe fills up, waitpid will never return. That's why select is required. (Or in this case, can_read since we don't feed any input to cvs.)

#!/usr/bin/perl

use strict;
use warnings;

use IO::Select qw( );
use IPC::Open3 qw( open3 );

use constant BLOCK_SIZE => 4096;

sub process_stdout {
   my ($fh) = @_;
   local *_;  # Protect caller's $_
   while (<$fh>) {
      chomp;
      print("[out:$_]\n");
   }
}

sub process_stderr {
   my ($fh) = @_;
   local *_;  # Protect caller's $_
   while (<$fh>) {
      chomp;
      print("[err:$_]\n");
   }
}

{
   # User-defined
   my $module = "mymodule";
   my $OLD    = "1.41";
   my $NEW    = "1.42";
   my $cmd    = "cvs rlog -r${OLD}::${NEW} -SN $module";

   my ($fh_cvs_in, $fh_cvs_out, $fh_cvs_err);
   my $pid = open3($fh_cvs_in, $fh_cvs_out, $fh_cvs_err, $cmd);

   my $r_sel = IO::Select->new($fh_cvs_out, $fh_cvs_err);

   my $cvs_out = '';
   my $cvs_err = '';

   while ($r_sel->handles()) {
      my @r = $r_sel->can_read();

      foreach my $fh (@r) {
         if ($fh == $fh_cvs_out) {
            my $rv = sysread($fh, $buf, BLOCK_SIZE, length($buf));

            if (not defined $rv) {
               die("Unable to communicate with CVS: $!\n");
            }

            if (not $rv) {  # End of file
               $r_sel->remove($fh_cvs_out);
            }
         }
         elsif ($fh == $fh_cvs_err) {
            my $rv = sysread($fh, $buf, BLOCK_SIZE, length($buf));

            if (not defined $rv) {
               die("Unable to communicate with CVS: $!\n");
            }

            if (not $rv) {  # End of file
               $r_sel->remove($fh_cvs_err);
            }
         }
      }
   }

   waitpid($pid, 0);

   {
      # Requires Perl 5.8.
      # In Perl 5.6, use IO::Scalar
      # or work with $csv_out directly.
      use 5.008000;
      open(my $fh, '<', \$cvs_out);
      process_stdout($fh);
   }

   {
      # Requires Perl 5.8.
      # In Perl 5.6, use IO::Scalar
      # or work with $csv_err directly.
      use 5.008000;
      open(my $fh, '<', \$cvs_err);
      process_stderr($fh);
   }
}
[download]

IPC::Run is designed to simplify this, but I have never used it.

use strict;
use warnings;

use IPC::Run qw( run ) ;

sub process_stdout {
   my ($fh) = @_;
   local *_;  # Protect caller's $_
   while (<$fh>) {
      chomp;
      print("[out:$_]\n");
   }
}

sub process_stderr {
   my ($fh) = @_;
   local *_;  # Protect caller's $_
   while (<$fh>) {
      chomp;
      print("[err:$_]\n");
   }
}

{
   # User-defined
   my $module = "mymodule";
   my $OLD    = "1.41";
   my $NEW    = "1.42";
   my @cmd    = ( 'cvs', 'rlog', "-r${OLD}::${NEW}" '-SN', $module );

   my $cvs_in  = '';
   my $cvs_out = '';
   my $cvs_err = '';

   run \@cmd, \$cvs_in, \$cvs_out, \$cvs_err
      or die("Unable to launch CVS\n");

   {
      # Requires Perl 5.8.
      # In Perl 5.6, use IO::Scalar
      # or work with $csv_out directly.
      use 5.008000;
      open(my $fh, '<', \$cvs_out);
      process_stdout($fh);
   }

   {
      # Requires Perl 5.8.
      # In Perl 5.6, use IO::Scalar
      # or work with $csv_err directly.
      use 5.008000;
      open(my $fh, '<', \$cvs_err);
      process_stderr($fh);
   }
}
[download]

Neither snippet has been tested.
Either or both snippets may need to trap SIGPIPE.