CVE-2010-2252
Published: 6 July 2010
GNU Wget 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a 3xx redirect to a URL with a .wgetrc filename followed by a 3xx redirect to a URL with a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
wget Launchpad, Ubuntu, Debian |
dapper |
Released
(1.10.2-1ubuntu1.2)
|
| hardy |
Released
(1.10.2-3ubuntu1.2)
|
|
| jaunty |
Released
(1.11.4-2ubuntu1.2)
|
|
| karmic |
Released
(1.11.4-2ubuntu2.1)
|
|
| lucid |
Released
(1.12-1.1ubuntu2.1)
|
|
| upstream |
Needs triage
|
|
|
Patches: upstream: http://lists.gnu.org/archive/html/bug-wget/2010-07/msg00076.html |
||