BugTraq
[ MDVSA-2011:008 ] perl-CGI Jan 14 2011 07:57PM
security mandriva com
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2011:008
http://www.mandriva.com/security/
_______________________________________________________________________

Package : perl-CGI
Date : January 14, 2011
Affected: 2009.0, 2010.0, 2010.1, Corporate 4.0, Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

A vulnerability has been found and corrected in perl-CGI:

Unspecified vulnerability in CGI.pm 3.50 and earlier allows remote
attackers to inject arbitrary HTTP headers and conduct HTTP response
splitting attacks via unknown vectors. NOTE: this issue exists
because of an incomplete fix for CVE-2010-2761 (CVE-2010-4411).

Packages for 2009.0 are provided as of the Extended Maintenance
Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&products_id=490

The updated packages have been upgraded to the latest version (3.51)
which is not affected by this issue and in turn also brings many
bugfixes.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4411
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2009.0:
bed288aa189137713e62bce50686aca3 2009.0/i586/perl-CGI-3.51-0.1mdv2009.0.noarch.rpm
d457a05a1a4302adefec18b253754d1d 2009.0/i586/perl-CGI-Fast-3.51-0.1mdv2009.0.noarch.rpm
1469b385e3c10d90c826d258ddde08c9 2009.0/SRPMS/perl-CGI-3.51-0.1mdv2009.0.src.rpm

Mandriva Linux 2009.0/X86_64:
34ad905b585ae65a43d0b5b6558d2421 2009.0/x86_64/perl-CGI-3.51-0.1mdv2009.0.noarch.rpm
a271ca208b1336d3aa319559bb389ebc 2009.0/x86_64/perl-CGI-Fast-3.51-0.1mdv2009.0.noarch.rpm
1469b385e3c10d90c826d258ddde08c9 2009.0/SRPMS/perl-CGI-3.51-0.1mdv2009.0.src.rpm

Mandriva Linux 2010.0:
52136837cc7a00fec652eaf1e58d8f1e 2010.0/i586/perl-CGI-3.510.0-0.1mdv2010.0.noarch.rpm
76ebfc4c892dd550b16d85dafcf83afb 2010.0/i586/perl-CGI-Fast-3.510.0-0.1mdv2010.0.noarch.rpm
8461002129a736281b7cc9fa4107f65f 2010.0/SRPMS/perl-CGI-3.510.0-0.1mdv2010.0.src.rpm

Mandriva Linux 2010.0/X86_64:
f0a7e2f8075dfc90c038d4b37830ab8a 2010.0/x86_64/perl-CGI-3.510.0-0.1mdv2010.0.noarch.rpm
04e05ae82eb715820e2618edce7f92c3 2010.0/x86_64/perl-CGI-Fast-3.510.0-0.1mdv2010.0.noarch.rpm
8461002129a736281b7cc9fa4107f65f 2010.0/SRPMS/perl-CGI-3.510.0-0.1mdv2010.0.src.rpm

Mandriva Linux 2010.1:
293331ebe73c80d14472bf4953d3a69c 2010.1/i586/perl-CGI-3.510.0-0.1mdv2010.2.noarch.rpm
534416b0026b2f2f188a977f82179b52 2010.1/i586/perl-CGI-Fast-3.510.0-0.1mdv2010.2.noarch.rpm
8ee0047d12c98330fc0443a21e0ed46c 2010.1/SRPMS/perl-CGI-3.510.0-0.1mdv2010.2.src.rpm

Mandriva Linux 2010.1/X86_64:
d3f759828dd9cab01abd54ebf9535e16 2010.1/x86_64/perl-CGI-3.510.0-0.1mdv2010.2.noarch.rpm
b0d9480c99b01438f3f623f59cde6043 2010.1/x86_64/perl-CGI-Fast-3.510.0-0.1mdv2010.2.noarch.rpm
8ee0047d12c98330fc0443a21e0ed46c 2010.1/SRPMS/perl-CGI-3.510.0-0.1mdv2010.2.src.rpm

Corporate 4.0:
efd31847e0a6a505706182287895d645 corporate/4.0/i586/perl-CGI-3.51-0.1.20060mlcs4.noarch.rpm
3aaad32e2fc342784e7d45e6f823776e corporate/4.0/i586/perl-CGI-Fast-3.51-0.1.20060mlcs4.noarch.rpm
2280a0d4e37f810b66b85fb0dd370088 corporate/4.0/SRPMS/perl-CGI-3.51-0.1.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
2af8f248e81633a89b016dba03d9fb51 corporate/4.0/x86_64/perl-CGI-3.51-0.1.20060mlcs4.noarch.rpm
1034cf1c1ab76b3803702197ea78ee8a corporate/4.0/x86_64/perl-CGI-Fast-3.51-0.1.20060mlcs4.noarch.rpm
2280a0d4e37f810b66b85fb0dd370088 corporate/4.0/SRPMS/perl-CGI-3.51-0.1.20060mlcs4.src.rpm

Mandriva Enterprise Server 5:
ea731f274b34944018415f5a2eb46832 mes5/i586/perl-CGI-3.51-0.1mdvmes5.1.noarch.rpm
09dd56560337d5e9e38333c31d661a68 mes5/i586/perl-CGI-Fast-3.51-0.1mdvmes5.1.noarch.rpm
3d62cd7c30734db326820428733ed201 mes5/SRPMS/perl-CGI-3.51-0.1mdvmes5.1.src.rpm

Mandriva Enterprise Server 5/X86_64:
4dae69bec8bd7e9d51a6728aac3e3cf5 mes5/x86_64/perl-CGI-3.51-0.1mdvmes5.1.noarch.rpm
0fb4cfa2f3c5504207c2464cc8023cda mes5/x86_64/perl-CGI-Fast-3.51-0.1mdvmes5.1.noarch.rpm
3d62cd7c30734db326820428733ed201 mes5/SRPMS/perl-CGI-3.51-0.1mdvmes5.1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFNMHnimqjQ0CJFipgRAr4tAKDlxIToZ35cdZcr4L//zSNW2X99OQCfQOk0
ngxa5hgtwb/+LtiUQsRJY/g=
=yAaz
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus