CVE-2013-4407

HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22,
before 1.23) uses the part of the uploaded file’s name after the first “.”
character as the suffix of a temporary file, which makes it easier for
remote attackers to conduct attacks by leveraging subsequent behavior that
may assume the suffix is well-formed.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=721634&gt;