Gisle Aas libwww-perl 5.65
Approved changes feed: RSS · Atom
cpe:2.3:a:gisle_aas:libwww-perl:5.65:*:*:*:*:*:*:*
part: a version: 5.65 update: *
| Vendor | Gisle Aas (8b7dfef0-8867-5290-93ec-7d15b9c234ef) |
|---|---|
| Product | Libwww Perl (7bacf3d2-b49b-5fec-926f-1380f03e448e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:cpan/libwww-perl |
purl2cpe | 2026-06-01 10:11:46.275891 |
pkg:deb/debian/libwww-perl |
purl2cpe | 2026-06-01 10:11:46.275893 |
pkg:deb/ubuntu/libwww-perl |
purl2cpe | 2026-06-01 10:11:46.275894 |
pkg:github/libwww-perl/libwww-perl |
purl2cpe | 2026-06-01 10:11:46.275896 |
pkg:gitlab/redhat/perl-libwww-perl |
purl2cpe | 2026-06-01 10:11:46.275897 |
pkg:rpm/centos/perl-libwww-perl |
purl2cpe | 2026-06-01 10:11:46.275899 |
pkg:rpm/fedora/perl-libwww-perl |
purl2cpe | 2026-06-01 10:11:46.275901 |
pkg:rpm/opensuse/perl-libwww-perl |
purl2cpe | 2026-06-01 10:11:46.275902 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2011-0633 |
vulnerable | 2026-06-08 04:56:38.412314 |
Details available
The Net::HTTPS module in libwww-perl (LWP) before 6.00, as used in WWW::Mechanize, LWP::UserAgent, and other products, when running in environments that do not set the If-SSL-Cert-Subject header, does not enable full validation of SSL certificates by default, which allows remote attackers to spoof servers via man-in-the-middle (MITM) attacks involving hostnames that are not properly validated. NOTE: it could be argued that this is a design limitation of the Net::HTTPS API, and separate implementations should be independently assigned CVE identifiers for not working around this limitation. However, because this API was modified within LWP, a single CVE identifier has been assigned.
Published: 2011-05-13T22:00:00.000Z
Updated: 2024-09-16T17:53:46.874Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2010-2253 |
vulnerable | 2026-06-08 04:55:06.273881 |
Details available
lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a . (dot) character, which allows remote servers to create or overwrite files via (1) a 3xx redirect to a URL with a crafted filename or (2) a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.
Published: 2010-07-06T14:00:00.000Z
Updated: 2024-08-07T02:25:07.548Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.