Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 21 Jan 2014 10:59:53 -0800
From: Galen Charlton <>
Subject: CVE request: Perl module MARC::File::XML


I am the maintainer of the Perl module MARC::File::XML, which is used
by various applications to manipulate a metadata format used by
libraries, and would like to request the allocation of a CVE
identifier for an XXE vulnerability that is fixed in version 1.0.2 of
the module.  I have evidence that the vulnerability can be used in at
least one F/LOSS integrated library system, Koha, to perform an
application-level privilege escalation, and another one, Evergreen, is
likely vulnerable to disclosure of the contents of arbitrary files on
the server.  I am a committer to both of those projects.





Galen Charlton
Manager of Implementation
Equinox Software, Inc. / The Open Source Experts
direct: +1 770-709-5581
cell:   +1 404-984-4366
skype:  gmcharlt
Supporting Koha and Evergreen: &

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ