Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -6 articles for you...
89
security advisoryFedoracritical updateFedora 24: Advisories for Perl-File-Path Critical File Mode Risk
This release fixes a possible setting arbitrary mode on an arbitrary file in rmtree() and remove_tree() calls known as CVE-2017-6512.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-212f07c853 2017-06-16 13:14:50.415318 --------------------------------------------------------------------------------Name : perl-File-Path Product : Fedora 24 Version : 2.12 Release : 3.fc24 URL : https://metacpan.org/dist/File-Path Summary : Create or remove directory trees Description : This module provides a convenient way to create directories of arbitrary depth and to delete an entire directory subtree from the file system. --------------------------------------------------------------------------------Update Information: This release fixes a possible setting arbitrary mode on an arbitrary file in rmtree() and remove_tree() calls known as CVE-2017-6512. --------------------------------------------------------------------------------References: [ 1 ] Bug #1457832 - CVE-2017-6512 perl-File-Path: rmtree/remove_tree race condition https://bugzilla.redhat.com/show_bug.cgi?id=1457832 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade perl-File-Path' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Jun 16, 2017
•Critical
Fedora
89
security advisoryfedoracriticalFedora 9: FEDORA-2008-5739 Critical: Insecure Chmod in Rmtree
CVE-2008-2827 perl: insecure use of chmod in rmtree. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2008-5739 2008-06-26 02:42:21 --------------------------------------------------------------------------------Name : perl Product : Fedora 9 Version : 5.10.0 Release : 27.fc9 URL : https://www.perl.org/ Summary : The Perl programming language Description : Perl is a high-level programming language with roots in C, sed, awk and shell scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most common applications are system administration utilities and web programming. A large proportion of the CGI scripts on the web are written in Perl. You need the perl package installed on your system so that your system can handle Perl scripts. Install this package if you want to program in Perl or enable your system to handle Perl scripts. --------------------------------------------------------------------------------Update Information: CVE-2008-2827 perl: insecure use of chmod in rmtree --------------------------------------------------------------------------------ChangeLog: * Tue Jun 24 2008 Marcela Maslanova 4:5.10.0-27 - CVE-2008-2827 perl: insecure use of chmod in rmtree * Thu Jun 12 2008 Stepan Kasal 4:5.10.0-26 - make config parameter list consistent for 32bit and 64bit platforms, add config option -Dinc_version_list=none (#448735) - use perl_archname consistently - set siteprefix to prefix/local * Wed Jun 11 2008 Marcela Maslanova 4:5.10.0-25 - 447371 wrong access permission rt49003 * Mon May 26 2008 Marcela Maslanova 4:5.10.0-24 - 448392 upstream fix for assertion * Thu May 22 2008 Tom "spot" Callaway 4:5.10.0-23 - sparc64 breaks with the rpath hack patch applied * Mon May 19 2008 Marcela Maslanova 4:5.10.0-22 - 447142 upgrade CGI to 3.37 * Sat May 17 2008 Tom "spot" Callaway 4:5.10.0-21 - sparc64 fails two tests under mysterious circumstances. we need to get the rest of the tree moving, so we temporarily disable the tests on that arch. --------------------------------------------------------------------------------References: [ 1 ] Bug #452635 - CVE-2008-2827 perl: insecure use of chmod in rmtree https://bugzilla.redhat.com/show_bug.cgi?id=452635 --------------------------------------------------------------------------------This update can be installed with the "yum" update program. Use su -c 'yum update perl' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ Fedora-package-announce mailing list
Jun 26, 2008
•Critical
Fedora
91
security advisoryGentoosoftware updateGentoo: GLSA-200501-38:03 Normal: Perl Rmtree And DBI Tmpfile Issues
The rmtree race conditions were only partly fixed in the original GLSA. New versions of dev-lang/perl have been released to address the remaining issues (CAN-2005-0448). [More...]. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory [UPDATE] GLSA 200501-38:03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Perl: rmtree and DBI tmpfile vulnerabilities Date: January 26, 2005 Updated: March 15, 2005 Bugs: #75696, #78634, #79685 ID: 200501-38:03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Update ===== The rmtree race conditions were only partly fixed in the original GLSA. New versions of dev-lang/perl have been released to address the remaining issues (CAN-2005-0448). The updated sections appear below. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-perl/DBI = 1.37-r1 > = 1.38-r1 2 dev-lang/perl = 5.8.6-r4 *> = 5.8.5-r5 *> = 5.8.4-r4 *> = 5.8.2-r4 ------------------------------------------------------------------- 2 affected packages on all of their supported architectures. ------------------------------------------------------------------- Description ========== Javier Fernandez-Sanguino Pena discovered that the DBI library creates temporary files in an insecure, predictable way (CAN-2005-0077). Paul Szabo found out that"File::Path::rmtree" is vulnerable to various race conditions (CAN-2004-0452, CAN-2005-0448). Impact ===== A local attacker could create symbolic links in the temporary files directory that point to a valid file somewhere on the filesystem. When the DBI library or File::Path::rmtree is executed, this could be used to overwrite or remove files with the rights of the user calling these functions. Resolution ========= All Perl users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose dev-lang/perl All DBI library users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose dev-perl/DBI References ========= [ 1 ] CAN-2004-0452 [ 2 ] CAN-2005-0077 [ 3 ] CAN-2005-0448 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200501-38 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Mar 15, 2005
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!