CVE-2014-1626 XML External Entity (XXE) vulnerability in MARC::File::XML module before 1.0.2 for Perl, as used in Evergreen, Koha, perl4lib, and possibly other products, allows context-dependent attackers to read a...
MediumCVSS 5.0
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
XML External Entity (XXE) vulnerability in MARC::File::XML module before 1.0.2 for Perl, as used in Evergreen, Koha, perl4lib, and possibly other products, allows context-dependent attackers to read arbitrary files via a crafted XML file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libmarc-xml-perl(Debian:12) | < 1.0.2-1 | 1.0.2-1 |
| debian/libmarc-xml-perl(Debian:13) | < 1.0.2-1 | 1.0.2-1 |
| debian/libmarc-xml-perl(Debian:14) | < 1.0.2-1 | 1.0.2-1 |
| galen charlton marc-xml | <= 1.0.1 | No fix listed |
| galen charlton marc-xml | = 1.0 | No fix listed |
References
- Debian Security Tracker CVE-2014-1626 vendor-advisory
- [OPEN-ILS-GENERAL] 20140121 SECURITY release: MARC::File::XML 1.0.2 mailing-list
- [Koha] 20140122 SECURITY release: MARC::File::XML 1.0.2 mailing-list
- 102367 vdb-entry
- 55404 third-party-advisory vendor-advisory
- www.nntp.perl.org
- 65057 vdb-entry
- marcfile-xml-info-disc(90620) vdb-entry
- metacpan.org
- bugs.debian.org issue-tracking