| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <E1Pdpld-0006xE-8q@titan.mandriva.com> Date: Fri, 14 Jan 2011 20:57:00 +0100 From: security@...driva.com To: full-disclosure@...ts.grok.org.uk Subject: [ MDVSA-2011:008 ] perl-CGI -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2011:008 http://www.mandriva.com/security/ _______________________________________________________________________ Package : perl-CGI Date : January 14, 2011 Affected: 2009.0, 2010.0, 2010.1, Corporate 4.0, Enterprise Server 5.0 _______________________________________________________________________ Problem Description: A vulnerability has been found and corrected in perl-CGI: Unspecified vulnerability in CGI.pm 3.50 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unknown vectors. NOTE: this issue exists because of an incomplete fix for CVE-2010-2761 (CVE-2010-4411). Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more: http://store.mandriva.com/product_info.php?cPath=149&products_id=490 The updated packages have been upgraded to the latest version (3.51) which is not affected by this issue and in turn also brings many bugfixes. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4411 _______________________________________________________________________ Updated Packages: Mandriva Linux 2009.0: bed288aa189137713e62bce50686aca3 2009.0/i586/perl-CGI-3.51-0.1mdv2009.0.noarch.rpm d457a05a1a4302adefec18b253754d1d 2009.0/i586/perl-CGI-Fast-3.51-0.1mdv2009.0.noarch.rpm 1469b385e3c10d90c826d258ddde08c9 2009.0/SRPMS/perl-CGI-3.51-0.1mdv2009.0.src.rpm Mandriva Linux 2009.0/X86_64: 34ad905b585ae65a43d0b5b6558d2421 2009.0/x86_64/perl-CGI-3.51-0.1mdv2009.0.noarch.rpm a271ca208b1336d3aa319559bb389ebc 2009.0/x86_64/perl-CGI-Fast-3.51-0.1mdv2009.0.noarch.rpm 1469b385e3c10d90c826d258ddde08c9 2009.0/SRPMS/perl-CGI-3.51-0.1mdv2009.0.src.rpm Mandriva Linux 2010.0: 52136837cc7a00fec652eaf1e58d8f1e 2010.0/i586/perl-CGI-3.510.0-0.1mdv2010.0.noarch.rpm 76ebfc4c892dd550b16d85dafcf83afb 2010.0/i586/perl-CGI-Fast-3.510.0-0.1mdv2010.0.noarch.rpm 8461002129a736281b7cc9fa4107f65f 2010.0/SRPMS/perl-CGI-3.510.0-0.1mdv2010.0.src.rpm Mandriva Linux 2010.0/X86_64: f0a7e2f8075dfc90c038d4b37830ab8a 2010.0/x86_64/perl-CGI-3.510.0-0.1mdv2010.0.noarch.rpm 04e05ae82eb715820e2618edce7f92c3 2010.0/x86_64/perl-CGI-Fast-3.510.0-0.1mdv2010.0.noarch.rpm 8461002129a736281b7cc9fa4107f65f 2010.0/SRPMS/perl-CGI-3.510.0-0.1mdv2010.0.src.rpm Mandriva Linux 2010.1: 293331ebe73c80d14472bf4953d3a69c 2010.1/i586/perl-CGI-3.510.0-0.1mdv2010.2.noarch.rpm 534416b0026b2f2f188a977f82179b52 2010.1/i586/perl-CGI-Fast-3.510.0-0.1mdv2010.2.noarch.rpm 8ee0047d12c98330fc0443a21e0ed46c 2010.1/SRPMS/perl-CGI-3.510.0-0.1mdv2010.2.src.rpm Mandriva Linux 2010.1/X86_64: d3f759828dd9cab01abd54ebf9535e16 2010.1/x86_64/perl-CGI-3.510.0-0.1mdv2010.2.noarch.rpm b0d9480c99b01438f3f623f59cde6043 2010.1/x86_64/perl-CGI-Fast-3.510.0-0.1mdv2010.2.noarch.rpm 8ee0047d12c98330fc0443a21e0ed46c 2010.1/SRPMS/perl-CGI-3.510.0-0.1mdv2010.2.src.rpm Corporate 4.0: efd31847e0a6a505706182287895d645 corporate/4.0/i586/perl-CGI-3.51-0.1.20060mlcs4.noarch.rpm 3aaad32e2fc342784e7d45e6f823776e corporate/4.0/i586/perl-CGI-Fast-3.51-0.1.20060mlcs4.noarch.rpm 2280a0d4e37f810b66b85fb0dd370088 corporate/4.0/SRPMS/perl-CGI-3.51-0.1.20060mlcs4.src.rpm Corporate 4.0/X86_64: 2af8f248e81633a89b016dba03d9fb51 corporate/4.0/x86_64/perl-CGI-3.51-0.1.20060mlcs4.noarch.rpm 1034cf1c1ab76b3803702197ea78ee8a corporate/4.0/x86_64/perl-CGI-Fast-3.51-0.1.20060mlcs4.noarch.rpm 2280a0d4e37f810b66b85fb0dd370088 corporate/4.0/SRPMS/perl-CGI-3.51-0.1.20060mlcs4.src.rpm Mandriva Enterprise Server 5: ea731f274b34944018415f5a2eb46832 mes5/i586/perl-CGI-3.51-0.1mdvmes5.1.noarch.rpm 09dd56560337d5e9e38333c31d661a68 mes5/i586/perl-CGI-Fast-3.51-0.1mdvmes5.1.noarch.rpm 3d62cd7c30734db326820428733ed201 mes5/SRPMS/perl-CGI-3.51-0.1mdvmes5.1.src.rpm Mandriva Enterprise Server 5/X86_64: 4dae69bec8bd7e9d51a6728aac3e3cf5 mes5/x86_64/perl-CGI-3.51-0.1mdvmes5.1.noarch.rpm 0fb4cfa2f3c5504207c2464cc8023cda mes5/x86_64/perl-CGI-Fast-3.51-0.1mdvmes5.1.noarch.rpm 3d62cd7c30734db326820428733ed201 mes5/SRPMS/perl-CGI-3.51-0.1mdvmes5.1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFNMHnimqjQ0CJFipgRAr4tAKDlxIToZ35cdZcr4L//zSNW2X99OQCfQOk0 ngxa5hgtwb/+LtiUQsRJY/g= =yAaz -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists