ubuntu · CVE-2011-1586

Quick triage

View at Official ubuntu advisory, NVD, CVE.org · CVE detail

Freshness: upstream tracker timestamp is available; use API updated time as primary recency signal.

Tracker summary

CVE-2011-1586 medium priority: Ubuntu including 1 source packages (kdenetwork), 6 status rows across 6 suites (dapper, hardy, karmic, lucid, maverick, upstream): released 3, ignored 2, needs-triage 1.

Description:

Directory traversal vulnerability in the KGetMetalink::File::isValidNameAttr function in ui/metalinkcreator/metalinker.cpp in KGet in KDE SC 4.6.2 and earlier allows remote attackers to create arbitrary files via a .. (dot dot) in the name attribute of a file element in a metalink file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-1000.