CVE-2011-5060 The par_mktmpdir function in the PAR module before 1.003 for Perl creates temporary files in a directory with a predictable name without verifying ownership and permissions of this directory, which al...
LowCVSS 3.3
EPSS 0.29%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The par_mktmpdir function in the PAR module before 1.003 for Perl creates temporary files in a directory with a predictable name without verifying ownership and permissions of this directory, which allows local users to overwrite files when another user extracts a PAR packed program, a different vulnerability in a different package than CVE-2011-4114.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libpar-perl(Debian:12) | < 1.005-1 | 1.005-1 |
| debian/libpar-perl(Debian:13) | < 1.005-1 | 1.005-1 |
| debian/libpar-perl(Debian:14) | < 1.005-1 | 1.005-1 |
| roderich schupp par-packer module | <= 1.002 | No fix listed |
| roderich schupp par-packer module | = 0.63 | No fix listed |
| roderich schupp par-packer module | = 0.64 | No fix listed |
| roderich schupp par-packer module | = 0.65 | No fix listed |
| roderich schupp par-packer module | = 0.66 | No fix listed |
| roderich schupp par-packer module | = 0.67 | No fix listed |
| roderich schupp par-packer module | = 0.68 | No fix listed |
| roderich schupp par-packer module | = 0.69 | No fix listed |
| roderich schupp par-packer module | = 0.70 | No fix listed |
| roderich schupp par-packer module | = 0.71 | No fix listed |
| roderich schupp par-packer module | = 0.72 | No fix listed |
| roderich schupp par-packer module | = 0.73 | No fix listed |
| roderich schupp par-packer module | = 0.74 | No fix listed |
| roderich schupp par-packer module | = 0.75 | No fix listed |
| roderich schupp par-packer module | = 0.76 | No fix listed |
| roderich schupp par-packer module | = 0.77 | No fix listed |
| roderich schupp par-packer module | = 0.78 | No fix listed |
| roderich schupp par-packer module | = 0.79 | No fix listed |
| roderich schupp par-packer module | = 0.80 | No fix listed |
| roderich schupp par-packer module | = 0.81 | No fix listed |
| roderich schupp par-packer module | = 0.82 | No fix listed |
| roderich schupp par-packer module | = 0.83 | No fix listed |
Show 41 more
| Product | Affected versions | Fixed in |
|---|---|---|
| roderich schupp par-packer module | = 0.85 | No fix listed |
| roderich schupp par-packer module | = 0.86 | No fix listed |
| roderich schupp par-packer module | = 0.87 | No fix listed |
| roderich schupp par-packer module | = 0.88 | No fix listed |
| roderich schupp par-packer module | = 0.89 | No fix listed |
| roderich schupp par-packer module | = 0.90 | No fix listed |
| roderich schupp par-packer module | = 0.91 | No fix listed |
| roderich schupp par-packer module | = 0.92 | No fix listed |
| roderich schupp par-packer module | = 0.93 | No fix listed |
| roderich schupp par-packer module | = 0.94 | No fix listed |
| roderich schupp par-packer module | = 0.941 | No fix listed |
| roderich schupp par-packer module | = 0.942 | No fix listed |
| roderich schupp par-packer module | = 0.951 | No fix listed |
| roderich schupp par-packer module | = 0.952 | No fix listed |
| roderich schupp par-packer module | = 0.953 | No fix listed |
| roderich schupp par-packer module | = 0.954 | No fix listed |
| roderich schupp par-packer module | = 0.955 | No fix listed |
| roderich schupp par-packer module | = 0.956 | No fix listed |
| roderich schupp par-packer module | = 0.957 | No fix listed |
| roderich schupp par-packer module | = 0.958 | No fix listed |
| roderich schupp par-packer module | = 0.959 | No fix listed |
| roderich schupp par-packer module | = 0.960 | No fix listed |
| roderich schupp par-packer module | = 0.970 | No fix listed |
| roderich schupp par-packer module | = 0.973 | No fix listed |
| roderich schupp par-packer module | = 0.975 | No fix listed |
| roderich schupp par-packer module | = 0.976 | No fix listed |
| roderich schupp par-packer module | = 0.977 | No fix listed |
| roderich schupp par-packer module | = 0.978 | No fix listed |
| roderich schupp par-packer module | = 0.979 | No fix listed |
| roderich schupp par-packer module | = 0.980 | No fix listed |
| roderich schupp par-packer module | = 0.981 | No fix listed |
| roderich schupp par-packer module | = 0.982 | No fix listed |
| roderich schupp par-packer module | = 0.991 | No fix listed |
| roderich schupp par-packer module | = 0.992_01 | No fix listed |
| roderich schupp par-packer module | = 0.992_02 | No fix listed |
| roderich schupp par-packer module | = 0.992_03 | No fix listed |
| roderich schupp par-packer module | = 0.992_04 | No fix listed |
| roderich schupp par-packer module | = 0.992_05 | No fix listed |
| roderich schupp par-packer module | = 0.992_06 | No fix listed |
| roderich schupp par-packer module | = 1.000 | No fix listed |
| roderich schupp par-packer module | = 1.001 | No fix listed |
References
- Debian Security Tracker CVE-2011-5060 vendor-advisory
- cpansearch.perl.org
- bugzilla.redhat.com patch
- par-parmktmpdir-symlink(72435) vdb-entry
- rt.cpan.org
- bugs.debian.org issue-tracking