Hello, 
that is what we got from vendor-sec (not public): 
 
From: Martin Schulze <joey@infodrom.org> 
To: Free Software Distribution Vendors <vendor-sec@lst.de> 
User-Agent: Mutt/1.5.6+20040907i 
Subject: [vendor-sec] CAN-2005-0077: Insecure temporary files in DBI 
Errors-To: vendor-sec-admin@lst.de 
Date: Wed, 19 Jan 2005 08:59:24 +0100 
 
Javier Fernández-Sanguino Peña from the Debian Security Audit Project 
discovered that the DBI library, the Perl5 database interface, creates 
a tmporary file in an insecure manner.  This can be exploited by a 
malicious user to overwrite arbitrary files owned by the person 
executing the program. 
 
This will be disclosed on Tuesday the 25th. 
 
Patch attached that will remove the use of this pid file. 
 
No reply from upstream yet. :( 
 
Regards, 
 
        Joey 
 
-- 
Ten years and still binary compatible.  -- XFree86 
 
--- libdbi-perl-1.21.orig/lib/DBI/ProxyServer.pm 
+++ libdbi-perl-1.21/lib/DBI/ProxyServer.pm 
[...]