The following vulnerabilities have been fixed in perl-CGI-Simple:
CVE-2010-4410 - crlf injection CVE-2010-4411 - incomplete fix for crlf injection

Multiple header injection problems in the CGI module of perl have been fixed. They allowed to inject HTTP headers in responses.

  - have been assigned to this issue. (CVE-2010-2761 /     CVE-2010-4410 / CVE-2010-4411)

Some serious security issues were discovered in Bugzilla and have been fixed in 3.4.10 and 3.6.4.

See http://www.bugzilla.org/security/3.2.9/ for details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been found and corrected in perl-CGI :

Unspecified vulnerability in CGI.pm 3.50 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unknown vectors. NOTE: this issue exists because of an incomplete fix for CVE-2010-2761 (CVE-2010-4411).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been upgraded to the latest version (3.51) which is not affected by this issue and in turn also brings many bugfixes.

The remote host is affected by the vulnerability described in GLSA-201110-03 (Bugzilla: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Bugzilla. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could conduct cross-site scripting attacks, conduct       script insertion and spoofing attacks, hijack the authentication of       arbitrary users, inject arbitrary HTTP headers, obtain access to       arbitrary accounts, disclose the existence of confidential groups and its       names, or inject arbitrary e-mail headers.
    A local attacker could disclose the contents of temporarfy files for       uploaded attachments.
  Workaround :

    There is no known workaround at this time.

Multiple header injection problems in the CGI module of perl have been fixed. They allowed to inject HTTP headers in responses.
CVE-2010-2761, CVE-2010-4410 and CVE-2010-4411 have been assigned to this issue.

ID	Name	Product	Family	Published	Updated	Severity
53791	openSUSE Security Update : perl-CGI-Simple (openSUSE-SU-2011:0083-1)	Nessus	SuSE Local Security Checks	5/5/2011	1/14/2021	medium
51641	SuSE 10 Security Update : Perl (ZYPP Patch Number 7316)	Nessus	SuSE Local Security Checks	1/21/2011	1/19/2021	medium
51855	Fedora 14 : bugzilla-3.6.4-1.fc14 (2011-0741)	Nessus	Fedora Local Security Checks	2/3/2011	1/11/2021	high
51800	Mandriva Linux Security Advisory : perl-CGI (MDVSA-2011:008)	Nessus	Mandriva Local Security Checks	1/28/2011	1/6/2021	medium
56445	GLSA-201110-03 : Bugzilla: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	10/11/2011	1/6/2021	high
51856	Fedora 13 : bugzilla-3.4.10-1.fc13 (2011-0755)	Nessus	Fedora Local Security Checks	2/3/2011	1/11/2021	high
75705	openSUSE Security Update : perl (openSUSE-SU-2011:0064-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/14/2021	medium

Detections

Analytics

Plugins Search

medium

medium

high

medium

high

high

medium