Mageia alert MGASA-2012-0346 (perl-CGI)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2012-0346: perl-CGI-3.630.0-1.mga (1,
 2/core) 
Date:
    	     
 
Thu, 29 Nov 2012 22:46:29 +0100
Message-ID:
    	     
 
<20121129214629.GA29735@valstar.mageia.org>
Archive-link:
    	     
 
Article, Thread
              
MGASA-2012-0346
Date: 	November 29th, 2012
Affected releases: 	1, 2


Description:
Updated perl-CGI package fixes security vulnerability:

CGI.pm module before 3.63 for Perl does not properly escape newlines in
(1) Set-Cookie or (2) P3P headers, which might allow remote attackers to
inject arbitrary headers into responses from applications that use CGI.pm
(CVE-2012-5526).


Updated Packages:
Mageia 1:
perl-CGI-3.630.0-1.mga1
perl-CGI-Fast-3.630.0-1.mga1

Mageia 2:
perl-CGI-3.630.0-1.mga2
perl-CGI-Fast-3.630.0-1.mga2


References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5526

https://bugs.mageia.org/show_bug.cgi?id=8236

https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-...