Описание
lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a . (dot) character, which allows remote servers to create or overwrite files via (1) a 3xx redirect to a URL with a crafted filename or (2) a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.
| Релиз | Статус | Примечание |
|---|---|---|
| dapper | released | 5.803-4ubuntu0.1 |
| devel | not-affected | 5.836-1 |
| hardy | released | 5.808-1ubuntu0.1 |
| jaunty | released | 5.820-1ubuntu0.1 |
| karmic | released | 5.831-1ubuntu0.1 |
| lucid | released | 5.834-1ubuntu0.1 |
| upstream | released | 5.835 |
Показывать по
EPSS
6.8 Medium
CVSS2
Связанные уязвимости
lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a . (dot) character, which allows remote servers to create or overwrite files via (1) a 3xx redirect to a URL with a crafted filename or (2) a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.
lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a . (dot) character, which allows remote servers to create or overwrite files via (1) a 3xx redirect to a URL with a crafted filename or (2) a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.
lwp-download in libwww-perl before 5.835 does not reject downloads to ...
lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a . (dot) character, which allows remote servers to create or overwrite files via (1) a 3xx redirect to a URL with a crafted filename or (2) a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.
EPSS
6.8 Medium
CVSS2