NVD

Id
8516  
Name
CVE-2011-1586  
Description
Directory traversal vulnerability in the KGetMetalink::File::isValidNameAttr function in ui/metalinkcreator/metalinker.cpp in KGet in KDE SC 4.6.2 and earlier allows remote attackers to create arbitrary files via a .. (dot dot) in the name attribute of a file element in a metalink file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-1000.  
Reject
 
CVSS Version
2  
CVSS Score
5.8  
Severity
Medium  
CVSS Base Score
5.8  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:P)  
Pub Date
2017-01-07  
Published
2011-04-26  
Modified Date
2011-09-06  
Seq
2011-1586  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
48967 8516 CVE-2011-1586 [oss-security] 20110415 Re: CVE Request: incomplete fix for CVE-2010-1000 in KDE network  View
48968 8516 CVE-2011-1586 http://websvn.kde.org/branches/KDE/4.4/kdenetwork/kget/ui/metalinkcreator/metalinker.cpp?r1=1227468&r2=1227467&pathrev=1227468  View
48969 8516 CVE-2011-1586 http://websvn.kde.org/branches/KDE/4.5/kdenetwork/kget/ui/metalinkcreator/metalinker.cpp?r1=1227469&r2=1227468&pathrev=1227469  View
48970 8516 CVE-2011-1586 http://websvn.kde.org/branches/KDE/4.6/kdenetwork/kget/ui/metalinkcreator/metalinker.cpp?r1=1227471&r2=1227470&pathrev=1227471  View
48971 8516 CVE-2011-1586 MDVSA-2011:081  View
48972 8516 CVE-2011-1586 RHSA-2011:0465  View
48973 8516 CVE-2011-1586 USN-1114-1  View
48974 8516 CVE-2011-1586 ADV-2011-1019  View
48975 8516 CVE-2011-1586 ADV-2011-1021  View
48976 8516 CVE-2011-1586 ADV-2011-1135  View
48977 8516 CVE-2011-1586 kget-name-directory-traversal(66826)  View
48978 8516 CVE-2011-1586 https://bugzilla.redhat.com/show_bug.cgi?id=697042  View
48979 8516 CVE-2011-1586 https://launchpad.net/bugs/757526  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
31354 JVNDB-2011-001594 KDE SC の KGet 内にある KGetMetalink::File::isValidNameAttr 関数におけるディレクトリトラバーサルの脆弱性 KDE SC の KGet 内にある ui/metalinkcreator/metalinker.cpp の KGetMetalink::File::isValidNameAttr 関数には、Metalink ファイルの file 要素内にある name 属性に関する処理に不備があるため、ディレクトリトラバーサルの脆弱性が存在します。 CVE-2011-1586 49493 CVE-2011-1586 8516 5.8 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-001594.html 2011-04-21 2011-05-18 View