paul Posted May 18, 2010 Report Share Posted May 18, 2010 A vulnerability has been discovered and fixed in kget (kdenetwork4): The name attribute of the file element of metalink files is not properly sanitized before being used to download files. If a user is tricked into downloading from a specially crafted metalink file, this can be exploited to download files to directories outside of the intended download directory via directory traversal attacks (CVE-2010-1000). Packages for 2009.0 are provided due to the Extended Maintenance Program. The corrected packages solves these problems. Link to comment Share on other sites More sharing options...
Recommended Posts