Perl HTML::Template::Pro Module XML External Entity Injection vulnerability

Bugtraq ID:	74333
Class:	Design Error
CVE:	CVE-2015-3451
Remote:	Yes
Local:	No
Published:	Apr 27 2015 12:00AM
Updated:	May 12 2015 07:51PM
Credit:	Tilmann Haak
Vulnerable:	Ubuntu Ubuntu Linux 15.04 Ubuntu Ubuntu Linux 14.10 Ubuntu Ubuntu Linux 14.04 LTS Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 CPAN XML::LibXML 2.0118 CPAN XML::LibXML 1.89
Not Vulnerable:	CPAN XML::LibXML 2.0119

Perl HTML::Template::Pro Module XML External Entity Injection vulnerability

The Perl XML::LibXML module is prone to XML External Entity injection vulnerability.

Successfully exploiting this issue may allow an attacker to cause denial-of-service condition or gain unauthorized access; this may aid in further attacks.

Perl HTML::Template::Pro Module XML External Entity Injection vulnerability

An attacker can exploit this issue using readily available tools.

Perl HTML::Template::Pro Module XML External Entity Injection vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Perl HTML::Template::Pro Module XML External Entity Injection vulnerability

References:

• Revision history for Perl extension XML::LibXML (Matt Sergeant, Christian Glahn, Petr Pajas)
  
• XML::LibXML Homepage (Shlomi Fish)