OS Command Injection in File-Find-Rule - CVE-2011-10007

Vulnerability identifier: #VU112028

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2011-10007

CWE-ID: CWE-78

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper input validation when `grep()` encounters a specially crafted filename. A local user can place a specially crafted file onto the system and execute arbitrary commands with privileges of the user running the affected application. 

File-Find-Rule
Gentoo Linux
Debian Linux
Anolis OS
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Fedora
openEuler
Ubuntu
perl-File-Find-Rule
perl-File-Find-Rule (Red Hat package)
libfile-find-rule-perl (Ubuntu package)
perl-File-Find-Rule-help
libfile-find-rule-perl (Debian package)
perl-File-Find-Rule-doc
dev-perl/File-Find-Rule
perl-File-Find-Rule-Perl
perl-File-Find-Rule-Perl (Red Hat package)

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

perl-File-Find-Rule - addressed in versions 0.33-5, 0.34-9, 0.34-26
perl-File-Find-Rule (Red Hat package) - addressed in versions 0.33-5.el7_9.1, 0.34-9.el8_10, 0.34-19.el9_4.1, 0.34-19.1.el9_6
libfile-find-rule-perl (Ubuntu package) - addressed in versions 0.34-1ubuntu0.22.04.1, 0.34-3ubuntu0.24.04.1, 0.34-3ubuntu0.24.10.1, 0.34-3ubuntu0.25.04.1
perl-File-Find-Rule - addressed in versions 0.34-3, 0.34-4
perl-File-Find-Rule-help - addressed in versions 0.34-3, 0.34-4
libfile-find-rule-perl (Debian package) - update to 0.34-4~deb12u1
perl-File-Find-Rule-doc - update to 0.34-26
perl-File-Find-Rule - addressed in versions 0.35-1.el10_0, 0.35-1.el10_1, 0.35-1.fc41, 0.35-1.fc42
dev-perl/File-Find-Rule - update to 0.350.0
perl-File-Find-Rule-Perl - update to 1.13-2
perl-File-Find-Rule-Perl (Red Hat package) - update to 1.13-2.el7_9.1

• http://www.openwall.com/lists/oss-security/2025/06/05/4
• http://www.openwall.com/lists/oss-security/2025/06/06/1
• http://www.openwall.com/lists/oss-security/2025/06/06/3
• https://github.com/richardc/perl-file-find-rule/commit/df58128bcee4c1da78c34d7f3fe1357e575ad56f.patch
• https://github.com/richardc/perl-file-find-rule/pull/4
• https://lists.debian.org/debian-lts-announce/2025/06/msg00006.html
• https://metacpan.org/release/RCLAMP/File-Find-Rule-0.34/source/lib/File/Find/Rule.pm#L423
• https://rt.cpan.org/Public/Bug/Display.html?id=64504

• Arbitrary code execution in File::Find::Rule
• Debian update for libfile-find-rule-perl
• Gentoo update for File-Find-Rule
• Fedora EPEL 10.1 update for perl-File-Find-Rule
• Fedora EPEL 10.0 update for perl-File-Find-Rule
• Fedora 42 update for perl-File-Find-Rule
• Fedora 41 update for perl-File-Find-Rule
• openEuler 22.03 LTS SP4 update for perl-File-Find-Rule
• openEuler 22.03 LTS SP3 update for perl-File-Find-Rule
• openEuler 20.03 LTS SP4 update for perl-File-Find-Rule
• openEuler 24.03 LTS SP1 update for perl-File-Find-Rule
• openEuler 24.03 LTS update for perl-File-Find-Rule
• Anolis OS update for perl-File-Find-Rule
• Anolis OS update for perl-File-Find-Rule
• Red Hat Enterprise Linux 9 update for perl-File-Find-Rule
• Red Hat Enterprise Linux 8 update for perl-File-Find-Rule
• Red Hat Enterprise Linux 9 update for perl-File-Find-Rule
• Red Hat Enterprise Linux 7 Extended Lifecycle Support update for perl-File-Find-Rule-Perl
• Red Hat Enterprise Linux 7 Extended Lifecycle Support update for perl-File-Find-Rule
• Ubuntu update for libfile-find-rule-perl
• Anolis OS update for perl-File-Find-Rule-Perl
• Anolis OS update for perl-File-Find-Rule
• openEuler 24.03 LTS SP2 update for perl-File-Find-Rule