CVE-2011-4114: The par_mktmpdir function in the PAR::Packer module before 1.012 for Perl creates temporary files in a dire...

Security readout for executives and security teams

This flaw affects PAR::Packer for Perl before version 1.012. It used predictable temporary directory names without sufficiently checking directory ownership and permissions. In shared systems, a local user could interfere when another user extracts a PAR-packed program, potentially causing file overwrite. No CVSS score or active exploitation evidence is provided. Exposure is most likely on Unix-like multi-user systems running Perl applications or tools packaged with PAR::Packer before 1.012, especially where users run or extract PAR-packed programs in shared temporary directories. Treat this as a targeted local privilege-adjacent risk rather than an internet-facing emergency. Prioritize shared Linux/Unix environments, developer build hosts, and hosting platforms where untrusted local users coexist with privileged or sensitive PAR-packed program execution. Mitigation focus: Upgrade PAR::Packer to version 1.012 or later.; Apply relevant operating-system package updates, including referenced Fedora advisories where applicable.; Inventory systems for CPAN or distro-installed PAR::Packer packages..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.