CVE-2014-1875

Published: Oct 6, 2014Modified: May 6, 2026

3.6

Vector

AV:L/AC:L/Au:N/C:N/I:P/A:P

Exploitability: 3.9 / Impact: 4.9

Source: NVD

Description

The Capture::Tiny module before 0.24 for Perl allows local users to write to arbitrary files via a symlink attack on a temporary file.

Affected (4)

Products: Cspan: Capture Tiny

Cspan

1 product

Capture Tiny

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Cspan Capture Tiny	Up to 0.23
Cspan Capture Tiny	Version 0.20
Cspan Capture Tiny	Version 0.21
Cspan Capture Tiny	Version 0.22

Related CWEs

CWE-59

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (26)

http://cpansearch.perl.org/src/DAGOLDEN/Capture-Tiny-0.24/Changes

Source: security@debian.org

http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128823.html

Source: security@debian.org

http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128882.html

Source: security@debian.org

http://osvdb.org/102963

Source: security@debian.org

http://seclists.org/oss-sec/2014/q1/267

Source: security@debian.org

Exploit

http://seclists.org/oss-sec/2014/q1/272

Source: security@debian.org

http://secunia.com/advisories/56823

Source: security@debian.org

http://www.securityfocus.com/bid/65475

Source: security@debian.org

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737835

Source: security@debian.org

Exploit

https://bugzilla.redhat.com/show_bug.cgi?id=1062424

Source: security@debian.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/91464

Source: security@debian.org

https://github.com/dagolden/Capture-Tiny/commit/635c9eabd52ab8042b0c841823bd6e692de87924

Source: security@debian.org

https://github.com/dagolden/Capture-Tiny/issues/16

Source: security@debian.org

Exploit

http://cpansearch.perl.org/src/DAGOLDEN/Capture-Tiny-0.24/Changes