Fedora alert FEDORA-2011-0653 (perl-CGI-Simple)
| From: | updates@fedoraproject.org | |
| To: | package-announce@lists.fedoraproject.org | |
| Subject: | [SECURITY] Fedora 14 Update: perl-CGI-Simple-1.113-1.fc14 | |
| Date: | Sun, 30 Jan 2011 19:52:02 +0000 | |
| Message-ID: | <20110130195202.6B0FD110691@bastion02.phx2.fedoraproject.org> |
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2011-0653 2011-01-21 22:14:28 -------------------------------------------------------------------------------- Name : perl-CGI-Simple Product : Fedora 14 Version : 1.113 Release : 1.fc14 URL : http://search.cpan.org/dist/CGI-Simple/ Summary : Simple totally OO CGI interface that is CGI.pm compliant Description : Simple totally OO CGI interface that is CGI.pm compliant. -------------------------------------------------------------------------------- Update Information: Update to 1.113 and apply additional patch to resolve CVE-2010-4410. Fix boundary to use randomized value as opposed to hardcoded value. -------------------------------------------------------------------------------- ChangeLog: * Fri Jan 21 2011 Tom Callaway <spot@fedoraproject.org> - 1.113-1 - Update to 1.113, apply additional patch to fully resolve CVE-2010-4411 * Wed Dec 1 2010 Tom "spot" Callaway <tcallawa@redhat.com> - 1.112-2 - patch for randomizing boundary (bz 658973) -------------------------------------------------------------------------------- References: [ 1 ] Bug #658976 - perl-CGI, perl-CGI-Simple: CVE-2010-2761 -- hardcoded value of the MIME boundary string in multipart/x-mixed-replace content, CVE-2010-4410 -- CRLF injection vulnerability in the header function https://bugzilla.redhat.com/show_bug.cgi?id=658976 [ 2 ] Bug #658970 - perl-CGI-Simple: CRLF injection vulnerability via a crafted URL https://bugzilla.redhat.com/show_bug.cgi?id=658970 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update perl-CGI-Simple' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list package-announce@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/package-...