{"id":"CVE-2014-5260","aliases":["DEBIAN-CVE-2014-5260","EUVD-2014-5153","GHSA-2f6x-v9qj-8f54","MGASA-2014-0390"],"status":"published","title":"The (1) mkxmltype and (2) mkdtskel scripts in XML-DT before 0.64 allow local users to overwrite...","description":"The (1) mkxmltype and (2) mkdtskel scripts in XML-DT before 0.64 allow local users to overwrite arbitrary files via a symlink attack on a /tmp/_xml_##### temporary file.","severity":{"version":"2.0","score":6.3,"vector":"AV:L/AC:M/Au:N/C:N/I:C/A:C","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00349,"percentile":0.28694,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2014-08-16T01:00:00Z","modified":"2026-10-23T15:47:29Z","fixes":[{"ecosystem":"Debian:12","package":"libxml-dt-perl","fixed_in":["0.66-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libxml-dt-perl","fixed_in":["0.66-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxml-dt-perl","fixed_in":["0.66-1"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"perl-XML-DT","fixed_in":["0.660.0-1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"perl-XML-DT","fixed_in":["0.660.0-1.mga4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libxml-dt-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.66-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libxml-dt-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.66-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libxml-dt-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.66-1"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"perl-XML-DT","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.660.0-1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"perl-XML-DT","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.660.0-1.mga4"}]}]}],"products":[{"vendor":"xml-dt_project","product":"xml-dt"}],"references":[{"url":"https://metacpan.org/source/AMBS/XML-DT-0.66/Changes","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://bugs.debian.org/756566","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://metacpan.org/diff/file?target=AMBS/XML-DT-0.64/\u0026source=AMBS/XML-DT-0.63/","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://openwall.com/lists/oss-security/2014/08/15/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-5260"},{"url":"https://metacpan.org/diff/file?target=AMBS/XML-DT-0.64/\u0026source=AMBS/XML-DT-0.63"},{"url":"https://github.com/advisories/GHSA-2f6x-v9qj-8f54"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-5260","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0390.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13931","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-5260","description":"The (1) mkxmltype and (2) mkdtskel scripts in XML-DT before 0.64 allow local users to overwrite arbitrary files via a symlink attack on a /tmp/_xml_##### temporary file.","status":"published","published":"2014-08-16T01:00:00Z","modified":"2024-08-06T11:41:48.228Z","updated_at":"2026-11-02T14:33:41.553118Z"}],"euvd":[{"id":"EUVD-2014-5153","description":"The (1) mkxmltype and (2) mkdtskel scripts in XML-DT before 0.64 allow local users to overwrite arbitrary files via a symlink attack on a /tmp/_xml_##### temporary file.","status":"published","published":"2014-08-16T01:00:00Z","modified":"2024-08-06T11:41:48Z","updated_at":"2026-11-03T01:57:03.789124Z"}],"ghsa":[{"id":"GHSA-2f6x-v9qj-8f54","title":"The (1) mkxmltype and (2) mkdtskel scripts in XML-DT before 0.64 allow local users to overwrite...","description":"The (1) mkxmltype and (2) mkdtskel scripts in XML-DT before 0.64 allow local users to overwrite arbitrary files via a symlink attack on a /tmp/_xml_##### temporary file.","status":"published","published":"2022-05-17T04:37:34Z","modified":"2025-04-12T12:36:38Z","cwes":["CWE-59"],"updated_at":"2026-11-02T15:01:18.41255Z"}],"nvd":[{"id":"CVE-2014-5260","description":"The (1) mkxmltype and (2) mkdtskel scripts in XML-DT before 0.64 allow local users to overwrite arbitrary files via a symlink attack on a /tmp/_xml_##### temporary file.","status":"published","published":"2014-08-16T04:39:55.723Z","modified":"2026-06-17T00:11:17.56Z","cvss":[{"version":"2.0","score":6.3,"vector":"AV:L/AC:M/Au:N/C:N/I:C/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:02:55.19899Z"}],"osv":[{"id":"CVE-2014-5260","description":"The (1) mkxmltype and (2) mkdtskel scripts in XML-DT before 0.64 allow local users to overwrite arbitrary files via a symlink attack on a /tmp/_xml_##### temporary file.","status":"published","published":"2014-08-16T04:39:55Z","modified":"2026-04-16T06:22:39.315200161Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-5260","description":"The (1) mkxmltype and (2) mkdtskel scripts in XML-DT before 0.64 allow local users to overwrite arbitrary files via a symlink attack on a /tmp/_xml_##### temporary file.","status":"published","published":"2014-08-16T04:39:55.723Z","modified":"2026-10-23T15:47:29.305080891Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"MGASA-2014-0390","title":"Updated perl-XML-DT package fix CVE-2014-5260","description":"Updated perl-XML-DT package fixes security vulnerability:\n\nThe mkxmltype and mkdtskel scripts provided in perl-XML-DT allow local users\nto overwrite arbitrary files via a symlink attack on a /tmp/_xml_#####\ntemporary file (CVE-2014-5260).\n","status":"published","published":"2014-09-26T15:55:04Z","modified":"2026-04-16T06:24:24.557373458Z","updated_at":"2026-11-02T15:49:39.488462Z"}]}}