Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2016-10374 →

DEBIAN-CVE-2016-10374

perltidy through 20160302, as used by perlcritic, check-all-the-things, and other software, relies on the current working directory for certain output...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

perltidy through 20160302, as used by perlcritic, check-all-the-things, and other software, relies on the current working directory for certain output files and does not have a symlink-attack protection mechanism, which allows local users to overwrite arbitrary files by creating a symlink, as demonstrated by creating a perltidy.ERR symlink that the victim cannot delete.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 perltidy

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20140328-2"}]}]

Debian:13 perltidy

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20140328-2"}]}]

Debian:14 perltidy

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20140328-2"}]}]

Références

advisory security-tracker.debian.org