Every CVESearch/Get API key

CVE-2014-2277

The make_temporary_filename function in perltidy 20120701-1 and earlier allows local users to...

7.1 HighFix available

CVE-2014-2277 is a high vulnerability (CVSS 7.1) in Perltidy Project Perltidy, published March 31, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 29th percentile. Fixed in perltidy 20130922-1.

What does this mean?
Severity
7.1 HighCVSS 3.1, NVD
Exploit chance
0.35%EPSS, 29th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
20130922-1perltidy +4 more

Description

The make_temporary_filename function in perltidy 20120701-1 and earlier allows local users to obtain sensitive information or write to arbitrary files via a symlink attack, related to use of the tmpnam function.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.35%Down 0.7 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
perltidy
Debian:12
before 20130922-1
20130922-1
perltidy
Debian:13
before 20130922-1
20130922-1
perltidy
Debian:14
before 20130922-1
20130922-1
perltidy
Mageia:3
before 20121207.0.0-2.1.mga3
20121207.0.0-2.1.mga3
perltidy
Mageia:4
before 20121207.0.0-3.1.mga4
20121207.0.0-3.1.mga4

What each source reports

NVD Score used7.1

The make_temporary_filename function in perltidy 20120701-1 and earlier allows local users to obtain sensitive information or write to arbitrary files via a symlink attack, related to use of the tmpnam function.

Record
CVE-2014-2277
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0
3.6 LowAV:L/AC:L/Au:N/C:P/I:P/A:N
Weakness
CWE-284
Updated
2026-11-02
CVE ListNo score

The make_temporary_filename function in perltidy 20120701-1 and earlier allows local users to obtain sensitive information or write to arbitrary files via a symlink attack, related to use of the tmpnam function.

Record
CVE-2014-2277
Updated
2026-11-02
EUVDEUVD-2014-2315No score

The make_temporary_filename function in perltidy 20120701-1 and earlier allows local users to obtain sensitive information or write to arbitrary files via a symlink attack, related to use of the tmpnam function.

Record
EUVD-2014-2315
Updated
2026-11-03
GitHub AdvisoriesGHSA-g7r2-wjmp-vjj67.1

The make_temporary_filename function in perltidy 20120701-1 and earlier allows local users to...

The make_temporary_filename function in perltidy 20120701-1 and earlier allows local users to obtain sensitive information or write to arbitrary files via a symlink attack, related to use of the tmpnam function.

Record
GHSA-g7r2-wjmp-vjj6
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-284
Updated
2026-11-02
OSV7.1

The make_temporary_filename function in perltidy 20120701-1 and earlier allows local users to obtain sensitive information or write to arbitrary files via a symlink attack, related to use of the tmpnam function.

Record
CVE-2014-2277
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2014-22777.1

The make_temporary_filename function in perltidy 20120701-1 and earlier allows local users to obtain sensitive information or write to arbitrary files via a symlink attack, related to use of the tmpnam function.

Record
DEBIAN-CVE-2014-2277
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2014-22777.1

The make_temporary_filename function in perltidy 20120701-1 and earlier allows local users to obtain sensitive information or write to arbitrary files via a symlink attack, related to use of the tmpnam function.

Record
UBUNTU-CVE-2014-2277
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVMGASA-2014-0147No score

Updated perltidy package fixes security vulnerability

perltidy's make_temporary_filename() function insecurely created temporary files via the use of the tmpnam() function. A local attacker could use this flaw to perform a symbolic link attack (CVE-2014-2277).

Record
MGASA-2014-0147
Updated
2026-11-02

History

History
RecordedChangedSources
facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 7 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open