CVE-2012-5526

CGI.pm module before 3.63 for Perl does not properly escape newlines in (1) Set-Cookie or (2) P3P headers, which might allow remote attackers to inject arbitrary headers into responses from applications that use CGI.pm.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:N/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 82%
Affected Products (NVD)
VendorProductVersion
andy_armstrongcgi.pm
𝑥
≤ 3.62
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libcgi-pm-perl
bookworm
4.55-1
fixed
bullseye
4.51-1
fixed
sid
4.66-1
fixed
trixie
4.66-1
fixed
perl
bookworm
5.36.0-7+deb12u1
fixed
bullseye
5.32.1-4+deb11u3
fixed
bullseye (security)
5.32.1-4+deb11u4
fixed
sid
5.40.0-6
fixed
trixie
5.40.0-6
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libcgi-pm-perl
hardy
dne
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
saucy
not-affected
trusty
dne
utopic
not-affected
vivid
not-affected
wily
not-affected
xenial
not-affected
yakkety
not-affected
zesty
not-affected
perl
hardy
Fixed 5.8.8-12ubuntu0.7
released
lucid
Fixed 5.10.1-8ubuntu2.2
released
oneiric
Fixed 5.12.4-4ubuntu0.1
released
precise
Fixed 5.14.2-6ubuntu2.2
released
quantal
Fixed 5.14.2-13ubuntu0.1
released
raring
not-affected
saucy
not-affected
trusty
not-affected
utopic
not-affected
vivid
not-affected
wily
not-affected
xenial
not-affected
yakkety
not-affected
zesty
not-affected
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
perl
RHEL 6
4:5.10.1-130.el6_4
fixed
perl-Archive-Extract
RHEL 6
1:0.38-130.el6_4
fixed
perl-Archive-Tar
RHEL 6
0:1.58-130.el6_4
fixed
perl-CGI
RHEL 6
0:3.51-130.el6_4
fixed
perl-CPAN
RHEL 6
0:1.9402-130.el6_4
fixed
perl-CPANPLUS
RHEL 6
0:0.88-130.el6_4
fixed
perl-Compress-Raw-Bzip2
RHEL 6
0:2.020-130.el6_4
fixed
perl-Compress-Raw-Zlib
RHEL 6
1:2.020-130.el6_4
fixed
perl-Compress-Zlib
RHEL 6
0:2.020-130.el6_4
fixed
perl-Digest-SHA
RHEL 6
1:5.47-130.el6_4
fixed
perl-ExtUtils-CBuilder
RHEL 6
1:0.27-130.el6_4
fixed
perl-ExtUtils-Embed
RHEL 6
0:1.28-130.el6_4
fixed
perl-ExtUtils-MakeMaker
RHEL 6
0:6.55-130.el6_4
fixed
perl-ExtUtils-ParseXS
RHEL 6
1:2.2003.0-130.el6_4
fixed
perl-File-Fetch
RHEL 6
0:0.26-130.el6_4
fixed
perl-IO-Compress-Base
RHEL 6
0:2.020-130.el6_4
fixed
perl-IO-Compress-Bzip2
RHEL 6
0:2.020-130.el6_4
fixed
perl-IO-Compress-Zlib
RHEL 6
0:2.020-130.el6_4
fixed
perl-IO-Zlib
RHEL 6
1:1.09-130.el6_4
fixed
perl-IPC-Cmd
RHEL 6
1:0.56-130.el6_4
fixed
perl-Locale-Maketext-Simple
RHEL 6
1:0.18-130.el6_4
fixed
perl-Log-Message
RHEL 6
1:0.02-130.el6_4
fixed
perl-Log-Message-Simple
RHEL 6
0:0.04-130.el6_4
fixed
perl-Module-Build
RHEL 6
1:0.3500-130.el6_4
fixed
perl-Module-CoreList
RHEL 6
0:2.18-130.el6_4
fixed
perl-Module-Load
RHEL 6
1:0.16-130.el6_4
fixed
perl-Module-Load-Conditional
RHEL 6
0:0.30-130.el6_4
fixed
perl-Module-Loaded
RHEL 6
1:0.02-130.el6_4
fixed
perl-Module-Pluggable
RHEL 6
1:3.90-130.el6_4
fixed
perl-Object-Accessor
RHEL 6
1:0.34-130.el6_4
fixed
perl-Package-Constants
RHEL 6
1:0.02-130.el6_4
fixed
perl-Params-Check
RHEL 6
1:0.26-130.el6_4
fixed
perl-Parse-CPAN-Meta
RHEL 6
1:1.40-130.el6_4
fixed
perl-Pod-Escapes
RHEL 6
1:1.04-130.el6_4
fixed
perl-Pod-Simple
RHEL 6
1:3.13-130.el6_4
fixed
perl-Term-UI
RHEL 6
0:0.20-130.el6_4
fixed
perl-Test-Harness
RHEL 6
0:3.17-130.el6_4
fixed
perl-Test-Simple
RHEL 6
0:0.92-130.el6_4
fixed
perl-Time-HiRes
RHEL 6
4:1.9721-130.el6_4
fixed
perl-Time-Piece
RHEL 6
0:1.15-130.el6_4
fixed
perl-core
RHEL 6
0:5.10.1-130.el6_4
fixed
perl-devel
RHEL 6
4:5.10.1-130.el6_4
fixed
perl-libs
RHEL 6
4:5.10.1-130.el6_4
fixed
perl-parent
RHEL 6
1:0.221-130.el6_4
fixed
perl-suidperl
RHEL 6
4:5.10.1-130.el6_4
fixed
perl-version
RHEL 6
3:0.77-130.el6_4
fixed
Common Weakness Enumeration
References
http://cpansearch.perl.org/src/MARKSTOS/CGI.pm-3.63/Changes
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
http://rhn.redhat.com/errata/RHSA-2013-0685.html
http://secunia.com/advisories/51457
http://secunia.com/advisories/55314
http://www.debian.org/security/2012/dsa-2586
http://www.openwall.com/lists/oss-security/2012/11/15/6
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
http://www.securityfocus.com/bid/56562
http://www.securitytracker.com/id?1027780
http://www.ubuntu.com/usn/USN-1643-1
https://exchange.xforce.ibmcloud.com/vulnerabilities/80098
https://github.com/markstos/CGI.pm/pull/23
http://cpansearch.perl.org/src/MARKSTOS/CGI.pm-3.63/Changes
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
http://rhn.redhat.com/errata/RHSA-2013-0685.html
http://secunia.com/advisories/51457
http://secunia.com/advisories/55314
http://www.debian.org/security/2012/dsa-2586
http://www.openwall.com/lists/oss-security/2012/11/15/6
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
http://www.securityfocus.com/bid/56562
http://www.securitytracker.com/id?1027780
http://www.ubuntu.com/usn/USN-1643-1
https://exchange.xforce.ibmcloud.com/vulnerabilities/80098
https://github.com/markstos/CGI.pm/pull/23