CVE-2004-0452
Fixed in a distro release EPSS <1%
Race condition in the rmtree function in the File::Path module in Perl 5.6.1 and 5.8.4 sets read/write permissions for the world, which allows local users to delete arbitrary files and directories, and possibly read files and directories, via a symlink attack.
Products: larry_wall perl
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | perl | 5.8.4-5 |
| Debian 13 | perl | 5.8.4-5 |
| Debian 14 | perl | 5.8.4-5 |
| Debian 3.0 | perl | 5.6.1-8.8 |
| Debian 4.0 | perl | 5.8.8-7etch5 |
| Red Hat Enterprise Linux 3 | perl | 2:5.8.0-89.10 |
| Red Hat Enterprise Linux 3 | perl-CGI | 2:2.81-89.10 |
| Red Hat Enterprise Linux 3 | perl-CPAN | 2:1.61-89.10 |
| Red Hat Enterprise Linux 3 | perl-DB_File | 2:1.804-89.10 |
| Red Hat Enterprise Linux 3 | perl-debuginfo | 2:5.8.0-89.10 |
| Red Hat Enterprise Linux 3 | perl-suidperl | 2:5.8.0-89.10 |
| Red Hat Enterprise Linux 4 | perl | 3:5.8.5-12.1 |
| Red Hat Enterprise Linux 4 | perl-debuginfo | 3:5.8.5-12.1 |
| Red Hat Enterprise Linux 4 | perl-suidperl | 3:5.8.5-12.1.1 |