CVE catalog

CVE-2013-4407

libhttp-body-perl: CVE-2013-4407

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
2.88% · Oct 25, 2026

HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibhttp-body-perlsid1.23-1fixed
Debianlibhttp-body-perlforky1.23-1fixed
Debianlibhttp-body-perltrixie1.23-1fixed
Debianlibhttp-body-perlbookworm1.22-2fixed
Alpineperl-http-body3.161.12-r0vulnerable
Alpineperl-http-body3.161.15-r0vulnerable
Alpineperl-http-body3.161.17-r0vulnerable
Alpineperl-http-body3.161.22-r0vulnerable
Alpineperl-http-body3.161.22-r1vulnerable
Alpineperl-http-body3.161.22-r2fixed
Alpineperl-http-body3.171.12-r0vulnerable
Alpineperl-http-body3.171.15-r0vulnerable
Alpineperl-http-body3.171.17-r0vulnerable
Alpineperl-http-body3.171.22-r0vulnerable
Alpineperl-http-body3.171.22-r1vulnerable
Alpineperl-http-body3.171.22-r2fixed
Alpineperl-http-body3.181.12-r0vulnerable
Alpineperl-http-body3.181.15-r0vulnerable
Alpineperl-http-body3.181.17-r0vulnerable
Alpineperl-http-body3.181.22-r0vulnerable
Alpineperl-http-body3.181.22-r1vulnerable
Alpineperl-http-body3.181.22-r2vulnerable
Alpineperl-http-body3.181.22-r3fixed
Alpineperl-http-body3.191.12-r0vulnerable
Alpineperl-http-body3.191.15-r0vulnerable
Alpineperl-http-body3.191.17-r0vulnerable
Alpineperl-http-body3.191.22-r0vulnerable
Alpineperl-http-body3.191.22-r1vulnerable
Alpineperl-http-body3.191.22-r2vulnerable
Alpineperl-http-body3.191.22-r3vulnerable
Alpineperl-http-body3.191.22-r4fixed
Opensuseperl-HTTP-Bodytumbleweed1.22-1.4fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibhttp-body-perlsourcesid1.17-2not yet assignedNot reported[721634]
Debianlibhttp-body-perlsourceforky1.17-2not yet assignedNot reported[721634]
Debianlibhttp-body-perlsourcetrixie1.17-2not yet assignedNot reported[721634]
Debianlibhttp-body-perlsourcebookworm1.17-2not yet assignedNot reported[721634]
Alpineperl-http-bodyapk3.161.22-r2Not reportedALPINE-CVE-2013-4407Not reported
Alpineperl-http-bodyapk3.171.22-r2Not reportedALPINE-CVE-2013-4407Not reported
Alpineperl-http-bodyapk3.181.22-r3Not reportedALPINE-CVE-2013-4407Not reported
Alpineperl-http-bodyapk3.191.22-r4Not reportedALPINE-CVE-2013-4407Not reported
Opensuseperl-HTTP-Bodyrpmtumbleweed1.22-1.4Not reportedOPENSUSE-SU-2024:10492-1Not reported

[Debian bug #721634]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libhttp-body-perl]Fixed
    Details (2)

    • 1.22-2 · all · bookworm

      Fixed · Fixed: 1.17-2

      dsa · libhttp-body-perl · debian · bookworm; dsa · libhttp-body-perl · debian · 12

    • 1.22-2 · all · bookworm

      Fixed · Fixed: 1.17-2

      dsa · libhttp-body-perl · debian · bookworm; dsa · libhttp-body-perl · debian · 12

[Debian 13 (Trixie)]

  • [libhttp-body-perl]Fixed
    Details (2)

    • 1.23-1 · all · trixie

      Fixed · Fixed: 1.17-2

      dsa · libhttp-body-perl · debian · 13

    • 1.23-1 · all · trixie

      Fixed · Fixed: 1.17-2

      dsa · libhttp-body-perl · debian · 13

[openSUSE Tumbleweed]

  • [perl-HTTP-Body]Fixed

    Source package: [perl-HTTP-Body]

    Details (1)

    • 1.230.0-1.8 · noarch · tumbleweed

      Fixed · Fixed: 1.22-1.4

      dsa · perl-HTTP-Body · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]