Bug 389839 – <dev-perl/Parallel-ForkManager-1.20.0: Insecure Temporary Files (CVE-2011-4115)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2011-11-07 20:53:35 UTC]

From secunia security advisory at $URL:

Description:
The security issue is caused due to the application using temporary files in an insecure manner, which can be exploited to e.g. overwrite arbitrary files via symlink attacks.

The security issue is reported in version 0.7.9. Other versions may also be affected.


Solution:
Restrict access to trusted users only.

[Comment 1 Torsten Veller (RETIRED) 2012-12-25 12:35:41 UTC]

Fixed in dev-perl/Parallel-ForkManager-1.20.0

[Comment 2 Agostino Sarubbo 2012-12-25 16:15:15 UTC]

Arches, please test and mark stable:
=dev-perl/Parallel-ForkManager-1.20.0
Target keywords : "alpha amd64 ia64 sparc x86"

[Comment 3 Vicente Olivert Riera (RETIRED) 2012-12-25 16:21:55 UTC]

(In reply to comment #2)
> Target keywords : "alpha amd64 ia64 sparc x86"

Have you forgot ppc?

[Comment 4 Agostino Sarubbo 2012-12-25 16:30:53 UTC]

(In reply to comment #3)
> Have you forgot ppc?

No.

In case of security bugs, we stabilize only on arch which have stable keyword.

[Comment 5 Agostino Sarubbo 2012-12-25 16:43:23 UTC]

amd64 stable

[Comment 6 Agostino Sarubbo 2012-12-25 16:43:45 UTC]

x86 stable

[Comment 7 Agostino Sarubbo 2012-12-25 22:28:16 UTC]

ia64 stable

[Comment 8 Agostino Sarubbo 2012-12-28 15:09:21 UTC]

sparc stable

[Comment 9 Agostino Sarubbo 2012-12-29 08:54:20 UTC]

alpha stable

[Comment 10 Sean Amoss (RETIRED) 2012-12-29 13:19:48 UTC]

GLSA vote: yes.

[Comment 11 Tim Sammut (RETIRED) 2013-01-02 18:48:13 UTC]

GLSA Vote: yes. Request filed.

[Comment 12 GLSAMaker/CVETool Bot 2013-10-17 09:11:32 UTC]

This issue was resolved and addressed in
 GLSA 201310-11 at http://security.gentoo.org/glsa/glsa-201310-11.xml
by GLSA coordinator Sergey Popov (pinkbyte).