CVE-2016-10374 | BDVDB-2026-85531 Detail

Description#

perltidy through 20160302, as used by perlcritic, check-all-the-things, and other software, relies on the current working directory for certain output files and does not have a symlink-attack protection mechanism, which allows local users to overwrite arbitrary files by creating a symlink, as demonstrated by creating a perltidy.ERR symlink that the victim cannot delete.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12017-05-17Record published in the CVE List.
2. Version 22024-09-17Most recent update recorded in the CVE List.