A race condition was found in the way the secure implementation of Ruby fileutils' remove system entries method (removeentrysecure()), removed directory trees. A local attacker could use this flaw to conduct symbolic link attacks, leading to removal of arbitrary files or directories on the system.

References: [1] http://www.ruby-lang.org/en/news/2011/02/18/fileutils-is-vulnerable-to-symlink-race-attacks/

Upstream patch (against trunk): [2] http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=30896