Two security vulnerabilities exist in the Apache 2 mod_perl2(3) module
components which affect the Apache 2.0 web server bundled with Solaris
10 and the Apache 2.2 web server bundled with OpenSolaris.
The first issue, a Denial of Service (DoS) vulnerability in the "RunPerl.pm"
component (CVE-2007-1349), may allow a remote unprivileged user to
cause a Denial of Service to the Apache 2 "httpd" process.
The second issue, a Cross Site Scripting (CSS or XSS) vulnerability in the
"Status.pm" component (CVE-2009-0796), may allow a remote unprivileged
user to inject arbitrary web script or HTML. This may allow the unprivileged
user to bypass access control and gain access to unauthorized data.
Additional information regarding these issues is available at:
CVE-2007-1349 at:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1349CVE-2009-0796 at:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0796
