[ GLSA 201402-04 ] libwww-perl: Multiple vulnerabilities

[GLSA]

Gentoo Linux Security Advisory

Title: libwww-perl: Multiple vulnerabilities (GLSA 201402-04)
Severity: normal
Exploitable: remote
Date: February 04, 2014
Bug(s): #329943, #386309
ID: 201402-04

Synopsis

Multiple vulnerabilities have been found in libwww-perl, the worst
of which could allow attackers to execute arbitrary code.


Background

libwww is a collection of Perl modules providing a consistent interface
to the World-Wide Web.


Affected Packages

Package: dev-perl/libwww-perl
Vulnerable: < 6.30.0
Unaffected: >= 6.30.0
Architectures: All supported architectures


Description

Multiple vulnerabilities have been discovered in libwww-perl. Please
review the CVE identifiers referenced below for details.


Impact

A remote attacker could entice a user to download a specially-crafted
file with an application linked against libwww-perl, which could result
in overwritten files or arbitrary code execution by writing to a dotfile
in the user’s home directory (such as .bashrc). Additionally, a remote
attacker could perform a Man-in-the-Middle attack.


Workaround

There is no known workaround at this time.

Resolution

All libwww-perl users should upgrade to the latest version: