CVE-2010-2253
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 3.3%
lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a . (dot) character, which allows remote servers to create or overwrite files via (1) a 3xx redirect to a URL with a crafted filename or (2) a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.
Produtos afetados
n/a · n/aReferências
http://cpansearch.perl.org/src/GAAS/libwww-perl-5.836/Changeshttp://lists.fedoraproject.org/pipermail/package-announce/2010-November/050232.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-November/050245.htmlhttp://marc.info/?l=oss-security&m=127411372529485&w=2http://marc.info/?l=oss-security&m=127611288927500&w=2https://bugzilla.redhat.com/show_bug.cgi?id=591580https://bugzilla.redhat.com/show_bug.cgi?id=602800http://www.ocert.org/advisories/ocert-2010-001.htmlhttp://www.ubuntu.com/usn/USN-981-1http://www.vupen.com/english/advisories/2010/2872