Unscored CVE-2008-4997 EUVD-2008-4976GHSA-w952-587w-j326

dfxml-invoice in datafreedom-perl 0.1.7 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/zenity temporary f…

Published Nov 7, 2008 · Updated Sep 17, 2024 · Assigned by mitre

Description

dfxml-invoice in datafreedom-perl 0.1.7 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/zenity temporary file. NOTE: the vendor disputes this vulnerability, stating that the vector is solely "an EXAMPLE used in the manpage.

References

[oss-security] 20081030 CVE requests: tempfile issues for aview, mgetty, openoffice, crossfire mailing-list
http://dev.gentoo.org/~rbu/security/debiantemp/datafreedom-perl
https://bugs.gentoo.org/show_bug.cgi?id=235770
http://bugs.debian.org/496429