CVE-2011-4114

The par_mktmpdir function in the PAR::Packer module before 1.012 for Perl
creates temporary files in a directory with a predictable name without
verifying ownership and permissions of this directory, which allows local
users to overwrite files when another user extracts a PAR packed program.
NOTE: a similar vulnerability was reported for PAR, but this has been
assigned a different CVE identifier.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=650706&gt;

Notes