CVE-2014-5260 The (1) mkxmltype and (2) mkdtskel scripts in XML-DT before 0.64 allow local users to overwrite arbitrary files via a symlink attack on a /tmp/xml##### temporary file.
MediumCVSS 6.3
EPSS 0.35%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The (1) mkxmltype and (2) mkdtskel scripts in XML-DT before 0.64 allow local users to overwrite arbitrary files via a symlink attack on a /tmp/xml##### temporary file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libxml-dt-perl(Debian:12) | < 0.66-1 | 0.66-1 |
| debian/libxml-dt-perl(Debian:13) | < 0.66-1 | 0.66-1 |
| debian/libxml-dt-perl(Debian:14) | < 0.66-1 | 0.66-1 |
| xml-dt project xml-dt | <= 0.63 | No fix listed |
| xml-dt project xml-dt | = 0.60 | No fix listed |
| xml-dt project xml-dt | = 0.61 | No fix listed |
| xml-dt project xml-dt | = 0.62 | No fix listed |
References
- Debian Security Tracker CVE-2014-5260 vendor-advisory
- [oss-security] 20140815 Re: CVE Request: XML-DT: Insecure use of temporary files mailing-list
- bugs.debian.org issue-tracking
- metacpan.org
- metacpan.org