CVE-2004-0452

NameCVE-2004-0452
DescriptionRace condition in the rmtree function in the File::Path module in Perl 5.6.1 and 5.8.4 sets read/write permissions for the world, which allows local users to delete arbitrary files and directories, and possibly read files and directories, via a symlink attack.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-1678-1, DSA-620-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
perl (PTS)bullseye5.32.1-4+deb11u3fixed
bullseye (security)5.32.1-4+deb11u4fixed
bookworm5.36.0-7+deb12u1fixed
sid, trixie5.40.0-7fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
perlsourcewoody5.6.1-8.8DSA-620-1
perlsourceetch5.8.8-7etch5DSA-1678-1
perlsource(unstable)5.8.4-5
Search for package or bug name: Reporting problems