CVE-2014-2277

The make_temporary_filename function in perltidy 20120701-1 and earlier allows local users to...

7.1 HighFix available

The make_temporary_filename function in perltidy 20120701-1 and earlier allows local users to obtain sensitive information or write to arbitrary files via a symlink attack, related to use of the tmpnam function.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

0.35%Down 0.7 points since Feb 4, 2022

What each source reports

NVD Score used 7.1

Record: CVE-2014-2277
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0: 3.6 LowAV:L/AC:L/Au:N/C:P/I:P/A:N
Weakness: CWE-284
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-2277
Updated: 2026-11-02

EUVDEUVD-2014-2315 No score

Record: EUVD-2014-2315
Updated: 2026-11-03

GitHub AdvisoriesGHSA-g7r2-wjmp-vjj6 7.1

The make_temporary_filename function in perltidy 20120701-1 and earlier allows local users to...

Record: GHSA-g7r2-wjmp-vjj6
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-284
Updated: 2026-11-02

OSV 7.1

Record: CVE-2014-2277
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-2277 7.1

Record: DEBIAN-CVE-2014-2277
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2014-2277 7.1

Record: UBUNTU-CVE-2014-2277
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVMGASA-2014-0147 No score

Updated perltidy package fixes security vulnerability

perltidy's make_temporary_filename() function insecurely created temporary files via the use of the tmpnam() function. A local attacker could use this flaw to perform a symbolic link attack (CVE-2014-2277).

Record: MGASA-2014-0147
Updated: 2026-11-02

Affected products

perltidy project perltidy

Affected packages

Affected packages
Package	Affected	Fixed
`perltidy` Debian:12	before 20130922-1	20130922-1
`perltidy` Debian:13	before 20130922-1	20130922-1
`perltidy` Debian:14	before 20130922-1	20130922-1
`perltidy` Mageia:3	before 20121207.0.0-2.1.mga3	20121207.0.0-2.1.mga3
`perltidy` Mageia:4	before 20121207.0.0-3.1.mga4	20121207.0.0-3.1.mga4

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-2277 is a high vulnerability (CVSS 7.1) in Perltidy Project Perltidy, published March 31, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 29th percentile. Fixed in perltidy 20130922-1.

References

Show 7 moreShow less