The "distcheck" Makefile rule in coreutils 5.2.1 through to 8.1 did use unsafe (predictable) temporary directory location for performing own tasks. This might allow local attacker to conduct symlink attacks under certain circumstances.
Upstream patch: --------------- http://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=ae034822c535fa5
Credit: ------- Jim Meyering
CVE Request: ------------ http://www.openwall.com/lists/oss-security/2009/12/08/4