CPANSA-XML-DT-2014-5260: XML-DT vulnerability

Publisher	giterlizzi	Document category	csaf_security_advisory
Initial release date	2014-08-16T00:00:00	Engine	CSAF Perl Toolkit 0.25
Current release date	2014-08-16T00:00:00	Build Date
Current version	1	Status	final
CVSS v3.1 Base Score		Severity
Original language		Language	en
Also referred to

Vulnerability Description

The (1) mkxmltype and (2) mkdtskel scripts in XML-DT before 0.64 allow local users to overwrite arbitrary files via a symlink attack on a /tmp/_xml_##### temporary file.

Vulnerabilities

CVE-2014-5260

Vulnerability Description

The (1) mkxmltype and (2) mkdtskel scripts in XML-DT before 0.64 allow local users to overwrite arbitrary files via a symlink attack on a /tmp/_xml_##### temporary file.

Weakness	CWE-59 : Improper Link Resolution Before File Access ('Link Following')

Product status

Known affected

Product

Score

XML-DT less than 0.64

CVSS Version	CVSS Vector	CVSS Base Score	CVSS Base Severity
2.0	AV:L/AC:M/Au:N/C:N/I:C/A:C	6.3	Medium

giterlizzi

Namespace: https://github.com/giterlizzi/

gdt@cpan.org

References

CPANSA-XML-DT-2014-5260 JSON self
https://raw.githubusercontent.com/giterlizzi/perl-CPANSA-CSAF/develop/csaf/white/2014/cpansa-xml-dt-2014-5260.json
http://openwall.com/lists/oss-security/2014/08/15/8 external
http://openwall.com/lists/oss-security/2014/08/15/8
https://metacpan.org/diff/file?target=AMBS/XML-DT-0.64/&source=AMBS/XML-DT-0.63/ external
https://metacpan.org/diff/file?target=AMBS/XML-DT-0.64/&source=AMBS/XML-DT-0.63/
https://metacpan.org/source/AMBS/XML-DT-0.66/Changes external
https://metacpan.org/source/AMBS/XML-DT-0.66/Changes
https://bugs.debian.org/756566 external
https://bugs.debian.org/756566
CVE-2014-5260 (NVD) external
https://nvd.nist.gov/vuln/detail/CVE-2014-5260

Revision history

Version	Date of the revision	Summary of the revision
1	Sat Aug 16 00:00:00 2014	First release

Sharing rules

TLP:WHITE
For the TLP version see: https://www.first.org/tlp/