On Mon, Dec 27, 2010 at 04:23:40PM +0200, Niko Tyni wrote: > On Mon, Dec 27, 2010 at 03:33:21PM +0200, Niko Tyni wrote: > > On Wed, Dec 08, 2010 at 08:53:28PM +0100, Moritz Muehlenhoff wrote: > > > On Wed, Dec 08, 2010 at 08:35:47PM +0100, Ansgar Burchardt wrote: > > > > Moritz Muehlenhoff <j...@debian.org> writes: > > > > > Three security issues have been reported in libcgi-pm-perl: > > > > > > > > > > http://security-tracker.debian.org/tracker/CVE-2010-2761 > > > > > http://security-tracker.debian.org/tracker/CVE-2010-4410 > > > > > http://security-tracker.debian.org/tracker/CVE-2010-4411 > > > > > > I'm not quite sure yet what CVE-2010-4411 refers to. It seems that the > > > > fix for CVE-2010-2761 was not complete, but it is not a different, new > > > > issue? > > > > > https://github.com/markstos/CGI.pm/commit/77b3b2056c003edee034a2a890212edab800900d > > > > Mark, is this double newline injection fix the new patch referred above?
I think this is confirmed by http://www.openwall.com/lists/oss-security/2011/01/04/9 which also contains a link to the corresponding CGI-Simple fix at http://github.com/markstos/CGI--Simple/commit/e811ab874a5e0ac8a99e76b645a0e537d8f714da There's going to be a new upstream release of CGI.pm soon. I hope I can make the time for perl 5.10.1-17 to unstable with just the CGI.pm fixes and urgency=high in the next few days. (If somebody else wants to do it, I'm ecstatic.) -- Niko Tyni nt...@debian.orgg -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
