It was discovered that the CGI module for Perl does not filter LF characters in the Set-Cookie and P3P headers, potentially allowing attackers to inject HTTP headers.

For the stable distribution (squeeze), this problem has been fixed in version 3.49-1squeeze2. For the unstable distribution (sid), this problem has been fixed in version 3.61-2. We recommend that you upgrade your libcgi-pm-perl packages.

CGI.pm is a Perl module that provides classes useful for creating Web forms and for parsing their contents. It defines CGI objects, entities that contain the values of the current query string and other state variables.

libcgi-pm-perl on Debian Linux

This check tests the installed software version using the apt package manager.

• http://www.debian.org/security/2012/dsa-2587.html

---

Updated on 2015-03-25