PT-2014-4264 · Perl · Marc::File::Xml

John Lightsey · Published 2014-01-26 · Updated 2017-08-29 · CVE-2014-1626

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions MARC::File::XML module versions prior to 1.0.2

Description The issue allows context-dependent attackers to read arbitrary files via a crafted XML file, potentially affecting products such as Evergreen, Koha, and perl4lib that utilize the MARC::File::XML module for Perl.

Recommendations For MARC::File::XML module versions prior to 1.0.2, update to version 1.0.2 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-1626

Affected Products

Marc::File::Xml

References · 16

• https://osv.dev/vulnerability/CVE-2014-1626 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-1626 · Security Note
• https://cve.org/CVERecord?id=CVE-2014-1626 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-1626 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-1626 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-1626 · Vendor Advisory
• http://secunia.com/advisories/55404 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-1626 · Vendor Advisory
• http://sourceforge.net/p/marcpm/code/ci/cf2d36597a56eeeffd53b38182b8557c7bf569ac · Note
• http://osvdb.org/102367 · Note
• https://metacpan.org/source/GMCHARLT/MARC-XML-1.0.2/Changes · Note
• http://lists.katipo.co.nz/pipermail/koha/2014-January/038430.html · Note
• http://securityfocus.com/bid/65057 · Note
• http://nntp.perl.org/group/perl.perl4lib/2014/01/msg3073.html · Note
• http://libmail.georgialibraries.org/pipermail/open-ils-general/2014-January/009442.html · Note