Jump to content

Advisories MDVSA-2010:098: kdenetwork4


Recommended Posts

A vulnerability has been discovered and fixed in kget (kdenetwork4):

 

The name attribute of the file element of metalink files is not

properly sanitized before being used to download files. If a user

is tricked into downloading from a specially crafted metalink file,

this can be exploited to download files to directories outside of

the intended download directory via directory traversal attacks

(CVE-2010-1000).

 

Packages for 2009.0 are provided due to the Extended Maintenance

Program.

 

The corrected packages solves these problems.

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
 Share

×
×
  • Create New...