Javier Fernández-Sanguino Peña discovered that the “dotty” tool
created and used temporary files in an insecure way. A local attacker
could exploit this with a symlink attack to create or overwrite
arbitrary files with the privileges of the user running dotty.