CVE-2014-1875 The Capture::Tiny module before 0.24 for Perl allows local users to write to arbitrary files via a symlink attack on a temporary file.
LowCVSS 3.6
EPSS 0.52%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Capture::Tiny module before 0.24 for Perl allows local users to write to arbitrary files via a symlink attack on a temporary file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libcapture-tiny-perl(Debian:12) | < 0.24-1 | 0.24-1 |
| debian/libcapture-tiny-perl(Debian:13) | < 0.24-1 | 0.24-1 |
| debian/libcapture-tiny-perl(Debian:14) | < 0.24-1 | 0.24-1 |
| cspan capture-tiny | <= 0.23 | No fix listed |
| cspan capture-tiny | = 0.20 | No fix listed |
| cspan capture-tiny | = 0.21 | No fix listed |
| cspan capture-tiny | = 0.22 | No fix listed |
References
- Debian Security Tracker CVE-2014-1875 vendor-advisory
- cpansearch.perl.org
- FEDORA-2014-2261 vendor-advisory
- FEDORA-2014-2321 vendor-advisory
- 102963 vdb-entry
- [oss-security] 20140206 CVE Request: Capture::Tiny: insecure use of /tmp exploit mailing-list
- [oss-security] 20140206 Re: CVE Request: Capture::Tiny: insecure use of /tmp mailing-list
- 56823 third-party-advisory
- 65475 vdb-entry
- bugs.debian.org exploit
- bugzilla.redhat.com
- capturetiny-perl-symlink(91464) vdb-entry
- github.com
- github.com exploit
- bugs.debian.org issue-tracking