DescriptionHTTP::Body::Multipart in the HTTP-Body 1.08, 1.17, and earlier module for Perl uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.
NVD CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
SUSE informationSUSE Bugzilla entry: 844951 SUSE Security Advisories:
- openSUSE-SU-2014:0433-1, published Tue, 25 Mar 2014 10:04:13 +0100 (CET)