User: Password:
|
|
Subscribe / Log in / New account

Mandriva alert MDVSA-2010:252 (perl-CGI-Simple)

From:  security@mandriva.com
To:  security-announce@mandrivalinux.org
Subject:  [Security Announce] [ MDVSA-2010:252 ] perl-CGI-Simple
Date:  Tue, 14 Dec 2010 16:57:01 +0100
Message-ID:  <E1PSXFN-0003qq-8m@titan.mandriva.com>
Archive-link:  Article, Thread

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2010:252 http://www.mandriva.com/security/ _______________________________________________________________________ Package : perl-CGI-Simple Date : December 14, 2010 Affected: Corporate 4.0, Enterprise Server 5.0 _______________________________________________________________________ Problem Description: A vulnerability was discovered and corrected in perl-CGI-Simple: CRLF injection vulnerability in the header function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via vectors related to non-whitespace characters preceded by newline characters, a different vulnerability than CVE-2010-2761 and CVE-2010-3172 (CVE-2010-4410). The updated packages have been patched to correct this issue. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4410 _______________________________________________________________________ Updated Packages: Corporate 4.0: 575a970c9dc85982b88b3610f881aeea corporate/4.0/i586/perl-CGI-Simple-0.077-1.2.20060mlcs4.noarch.rpm 4cf16af44ac7aeaee3e950f8029ae1ef corporate/4.0/SRPMS/perl-CGI-Simple-0.077-1.2.20060mlcs4.src.rpm Corporate 4.0/X86_64: 28c8101be550456f2406b9d1ccb81284 corporate/4.0/x86_64/perl-CGI-Simple-0.077-1.2.20060mlcs4.noarch.rpm 4cf16af44ac7aeaee3e950f8029ae1ef corporate/4.0/SRPMS/perl-CGI-Simple-0.077-1.2.20060mlcs4.src.rpm Mandriva Enterprise Server 5: 9f8ac88c6490d5e3c37abb221b88deb0 mes5/i586/perl-CGI-Simple-1.1-4.2mdvmes5.1.noarch.rpm d64f4d1322a327ac2f5a9bdde280525a mes5/SRPMS/perl-CGI-Simple-1.1-4.2mdvmes5.1.src.rpm Mandriva Enterprise Server 5/X86_64: 1c1dcd1d837926671b4a79a9e9147c2c mes5/x86_64/perl-CGI-Simple-1.1-4.2mdvmes5.1.noarch.rpm d64f4d1322a327ac2f5a9bdde280525a mes5/SRPMS/perl-CGI-Simple-1.1-4.2mdvmes5.1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFNB2exmqjQ0CJFipgRArWUAKClSubb6KQ00eoa8DAWb5y69HmE/gCgmK2M ZRCQ7M0z7QNT/LpwCauGua0= =jCE1 -----END PGP SIGNATURE----- To unsubscribe, send a email to sympa@mandrivalinux.org with this subject : unsubscribe security-announce _______________________________________________________ Want to buy your Pack or Services from Mandriva? Go to http://www.mandrivastore.com Join the Club : http://www.mandrivaclub.com _______________________________________________________


(Log in to post comments)


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds