CVE-2010-2761

Name	CVE-2010-2761
Description	The multipart_init function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier uses a hardcoded value of the MIME boundary string in multipart/x-mixed-replace content, which allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input that contains this value, a different vulnerability than CVE-2010-3172.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	medium
Debian Bugs	606370, 606379, 606995

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libcgi-pm-perl (PTS)	stretch	4.35-1	fixed
	buster	4.40-1	fixed
	bullseye, sid	4.50-1	fixed
libcgi-simple-perl (PTS)	bullseye, sid, buster, stretch	1.115-2	fixed
perl (PTS)	stretch	5.24.1-3+deb9u7	fixed
	stretch (security)	5.24.1-3+deb9u5	fixed
	buster	5.28.1-6+deb10u1	fixed
	bullseye, sid	5.30.3-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libcgi-pm-perl	source	lenny	3.38-2lenny2
libcgi-pm-perl	source	squeeze	3.49-1squeeze1
libcgi-pm-perl	source	(unstable)	3.50-1			606370
libcgi-simple-perl	source	lenny	1.105-1lenny1
libcgi-simple-perl	source	(unstable)	1.111-2			606379
perl	source	lenny	5.10.0-19lenny3			606995
perl	source	(unstable)	5.10.1-17			606995