QwikSec

Security Database

CVE

CWE

Training

CVE-2011-1586

Published: Apr 27, 2011

Modified: Aug 6, 2024

PUBLISHED

Description

Directory traversal vulnerability in the KGetMetalink::File::isValidNameAttr function in ui/metalinkcreator/metalinker.cpp in KGet in KDE SC 4.6.2 and earlier allows remote attackers to create arbitrary files via a .. (dot dot) in the name attribute of a file element in a metalink file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-1000.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://launchpad.net/bugs/757526

x_refsource_CONFIRM

http://websvn.kde.org/branches/KDE/4.4/kdenetwork/kget/ui/metalinkcreator/metalinker.cpp?r1=1227468&r2=1227467&pathrev=1227468

x_refsource_CONFIRM

http://websvn.kde.org/branches/KDE/4.6/kdenetwork/kget/ui/metalinkcreator/metalinker.cpp?r1=1227471&r2=1227470&pathrev=1227471

x_refsource_CONFIRM

third-party-advisory

x_refsource_SECUNIA

[oss-security] 20110415 Re: CVE Request: incomplete fix for CVE-2010-1000 in KDE network

mailing-list

x_refsource_MLIST

vdb-entry

x_refsource_VUPEN

vendor-advisory

x_refsource_REDHAT

vdb-entry

x_refsource_VUPEN

third-party-advisory

x_refsource_SECUNIA

http://websvn.kde.org/branches/KDE/4.5/kdenetwork/kget/ui/metalinkcreator/metalinker.cpp?r1=1227469&r2=1227468&pathrev=1227469

x_refsource_CONFIRM

vdb-entry

x_refsource_VUPEN

vendor-advisory

x_refsource_MANDRIVA

vendor-advisory

x_refsource_UBUNTU

kget-name-directory-traversal(66826)

vdb-entry

x_refsource_XF

https://bugzilla.redhat.com/show_bug.cgi?id=697042

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.