CVE-2008-4997: dfxml-invoice in datafreedom-perl 0.1.7 allows local users to overwrite arbitrary files via a symlink attac...

Security readout for executives and security teams

CVE-2008-4997 describes a reported local file-overwrite issue in datafreedom-perl 0.1.7 involving dfxml-invoice and a predictable /tmp/zenity temporary file. The vendor disputed the report, saying the vector was only an example in the manpage. There is no KEV listing or provided evidence of active exploitation. Exposure appears limited to systems with datafreedom-perl 0.1.7 or the disputed dfxml-invoice example present, especially multi-user Unix-like hosts. The source bundle lists affected vendor/product as n/a, so asset matching should rely on package and file inventory rather than CPE data. Treat this as a low-urgency validation item unless datafreedom-perl 0.1.7 is present on shared systems. The main business concern is local privilege-adjacent file overwrite risk, but evidence is disputed and incomplete. Mitigation focus: Check Debian, Gentoo, or vendor package guidance before choosing a fix.; Remove datafreedom-perl 0.1.7 if it is unused.; Do not run the disputed dfxml-invoice example with elevated privileges..

Prepared

Jun 28, 2026, 18:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.