Description
It was discovered that the XML::Atom Perl module before version 0.39 did not disable external entities when parsing XML from potentially untrusted sources. This may allow attackers to gain read access to otherwise protected resources, depending on how the library is used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | perl-xml-atom | perl-xml-atom 0.39 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libxml-atom-perl | 0.39-1 | — |
| Debian 13 | libxml-atom-perl | 0.39-1 | — |
| Debian 12 | libxml-atom-perl | 0.39-1 | — |
| Debian 6.0 | libxml-atom-perl | 0.37-1+squeeze1 | DSA-2424-1 |
Advisories 1
- DSA-2424-1 libxml-atom-perl - XML entity expansion Debian Security (DSA / DLA) · Mar 9, 2026