This is a repost and update of https://rt.cpan.org/Public/Bug/Display.html?id=69277 - the bug tracker that CPAN points to appears to have changed at some point since 2011.
A symlink attack via Data::UUID is possible.
ln -s /home/user1/test-file /tmp/.UUID_STATE
perl -MData::UUID -e 'Data::UUID->new'
Then /home/user1/test-file is overwritten.
There are two points in UUID.xs which write to UUID_STATE_NV_STORE - both the DESTROY() and create() functions are affected.
On at least recent Debian kernels, it is necessary to disable symlink protection via "sysctl fs.protected_symlinks=0" to reproduce this issue.
A similar attack is possible via .UUID_NODEID, but only if combined with exploiting the race condition between fopen and fwrite, so this is much more difficult to reproduce.
I have requested a CVE id from oss-security, and I will come back and update the report when one is assigned.
I really don't do anything on this library but apply patches. It's been without a dedicated maintainer almost since release. A patch for this issue would be appreciated.