Red Hat Bugzilla – Bug 753970
CVE-2011-4116 perl: File::Temp insecure temporary file handling
Last modified: 2015-08-22 02:54:18 EDT
A flaw was reported  in how perl's File::Temp module created temporary files and directories. File::Temp would create a file or directory without checking first whether or not the directory it was creating the file in, or a parent directory, was owned by root or the calling user in the case of symlinks or hardlinks. A malicious local attacker could use this to direct where temporary files were being created.
The upstream report has some discussion around how to fix the flaw, but does not have a patch.
Solar Designer's comments on this issue:
Solar has made concise comments about File::Temp safety levels, and whether this is a security issue. Regardless of the approach chosen from https://rt.cpan.org/Public/Bug/Display.html?id=69106#txn-999472 (I'd choose the 2), we are deferring this.
Created perl tracking bugs for this issue
Affects: fedora-all [bug 754107]
This issue has emerged on <https://rt.perl.org/rt3/Public/Bug/Display.html?id=110730>.
Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.