Mandriva Linux Security Advisory : perl-CGI (MDVSA-2012:180)

Medium Nessus Plugin ID 63284


The remote Mandriva Linux host is missing one or more security updates.


A vulnerability was discovered and corrected in perl-CGI : module before 3.63 for Perl does not properly escape newlines in (1) Set-Cookie or (2) P3P headers, which might allow remote attackers to inject arbitrary headers into responses from applications that use (CVE-2012-5526).

The updated packages have been patched to correct this issue.


Update the affected perl-CGI and / or perl-CGI-Fast packages.

Plugin Details

Severity: Medium

ID: 63284

File Name: mandriva_MDVSA-2012-180.nasl

Version: $Revision: 1.5 $

Type: local

Published: 2012/12/18

Modified: 2013/10/17

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 5

Temporal Score: 4.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:perl-CGI, p-cpe:/a:mandriva:linux:perl-CGI-Fast, cpe:/o:mandriva:linux:2011

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2012/12/17

Reference Information

CVE: CVE-2012-5526

BID: 56562

MDVSA: 2012:180