CVE-2011-4114 Path traversal in n/a

Low 3.3 Published 13 Jan 2012 Updated 7 Aug 2024

Local attackers can overwrite files via predictable temporary directory names in PAR::Packer when another user extracts a packed program.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2011-4114?

CVE-2011-4114 is a low-severity path traversal vulnerability in n/a, published on 13 Jan 2012. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The par_mktmpdir function in the PAR::Packer module before 1.012 for Perl creates temporary files in a directory with a predictable name without verifying ownership and permissions of this directory, which allows local users to overwrite files when another user extracts a PAR packed program. NOTE: a similar vulnerability was reported for PAR, but this has been assigned a different CVE identifier.

Weakness: CWE-264

Which versions are affected by CVE-2011-4114?

It affects 1 product.

Linux distribution packages (1)

perl-PAR openSUSE:Tumbleweed All versions 1.011-1.1

Products include Roderich Schupp Par-Packer Module.

How do I fix CVE-2011-4114?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2011-4114 being exploited?

There is no known exploitation of CVE-2011-4114 in the wild and no public exploit code.

CVE-2011-5060 Path traversal in n/a Low 3.3

Sources

Also known as DEBIAN-CVE-2011-4114, GHSA-gxwf-286g-rc8g, openSUSE-SU-2024:10232-1.