CVE-2008-4949: dist 3.5 allows local users to overwrite arbitrary files via a symlink attack on (a) /tmp/cil#####, (b) /tm...

Security readout for executives and security teams

CVE-2008-4949 is an old local file overwrite issue in dist 3.5. A local user may abuse insecure temporary files used by the patcil and patdiff scripts. Business risk is mainly for legacy systems that still install or run this package, especially if those scripts run with elevated privileges. Exposure is most plausible on legacy Unix-like systems with dist 3.5 installed. Risk increases where untrusted local users have shell access or where affected scripts are invoked by privileged users, packaging jobs, or automation. Treat this as a legacy exposure cleanup item unless dist 3.5 is present on multi-user or privileged automation systems. If present there, prioritize remediation because arbitrary file overwrite can undermine system integrity. Mitigation focus: Inventory systems for dist 3.5 and affected patcil or patdiff usage.; Check Debian, Gentoo, or vendor package guidance for fixed or removed packages.; Remove the package if it is unused or unsupported..

Prepared

Jun 28, 2026, 18:33 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.