Debian Security Advisory

DSA-371-1 perl -- cross-site scripting

Date Reported:
11 Aug 2003
Affected Packages:
Security database references:
In the Bugtraq database (at SecurityFocus): BugTraq ID 8231.
In Mitre's CVE dictionary: CVE-2003-0615.
More information:

A cross-site scripting vulnerability exists in the start_form() function in This function outputs user-controlled data into the action attribute of a form element without sanitizing it, allowing a remote user to execute arbitrary web script within the context of the generated page. Any program which uses this function in the module may be affected.

For the current stable distribution (woody) this problem has been fixed in version 5.6.1-8.3.

For the unstable distribution (sid) this problem has been fixed in version 5.8.0-19.

We recommend that you update your perl package.

Fixed in:

Debian GNU/Linux 3.0 (woody)

Architecture-independent component:
Intel IA-32:
Intel IA-64:
Motorola 680x0:
Big endian MIPS:
Little endian MIPS:
IBM S/390:
Sun Sparc:

MD5 checksums of the listed files are available in the original advisory.