| Package | Affected versions | Patched versions |
|---|---|---|
| par-packer module | = 0.63= 0.64= 0.65= 0.66= 0.67= 0.68= 0.69= 0.70= 0.71= 0.72= 0.73= 0.74= 0.75= 0.76= 0.77= 0.78= 0.79= 0.80= 0.81= 0.82= 0.83= 0.85= 0.86= 0.87= 0.88= 0.89= 0.90= 0.91= 0.92= 0.93= 0.94= 0.941= 0.942= 0.951= 0.952= 0.953= 0.954= 0.955= 0.956= 0.957= 0.958= 0.959= 0.960= 0.970= 0.973= 0.975= 0.976= 0.977= 0.978= 0.979= 0.980= 0.981= 0.982= 0.991= 0.992_01= 0.992_02= 0.992_03= 0.992_04= 0.992_05= 0.992_06= 1.000= 1.001= 1.002= 1.003= 1.004= 1.005= 1.006= 1.007= 1.008= 1.009= 1.010≤ 1.011 |
The par_mktmpdir function in the PAR::Packer module before 1.012 for Perl creates temporary files in a directory with a predictable name without verifying ownership and permissions of this directory, which allows local users to overwrite files when another user extracts a PAR packed program. NOTE: a similar vulnerability was reported for PAR, but this has been assigned a different CVE identifier.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free