lftp security update

3.7.11-4.el55.3 - Related: CVE-2010-2251 - document change of xfer:clobber default value in manpage, respect xfer:clobber on with xfer:auto-rename on old behaviour 3.7.11-4.el55.2 - Related: CVE-2010-2251 - describe new option xfer:auto-rename which could restore old behaviour in manpage...

Mandriva Linux Security Advisory : lftp (MDVSA-2010:128)

A vulnerability has been found and corrected in lftp : The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via...

Mandriva Update for lftp MDVSA-2010:128 (lftp)

Check for the Version of lftp OpenVAS Vulnerability Test Mandriva Update for lftp MDVSA-2010:128 lftp Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

Mandriva Update for lftp MDVSA-2010:128 (lftp)

Check for the Version of lftp OpenVAS Vulnerability Test Mandriva Update for lftp MDVSA-2010:128 lftp Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

lftp file overwrite

Downloaded file name in lftpget may be set by server without user confirmation...

[ MDVSA-2010:128 ] lftp

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2010:128 http://www.mandriva.com/security/ Package : lftp Date : July 6, 2010 Affected: 2008.0, 2009.0, 2009.1, 2010.0, Enterprise Server 5.0 Problem Description: A vulnerability has been found and corrected in...

CVE-2010-2251

The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted...

CVE-2010-2251

The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted...

DEBIAN-CVE-2010-2251

The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted...

Command injection

The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted...

CVE-2010-2251

The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted...

CVE-2010-2251

CVE-2010-2251 affects the FTP/HTTP client lftp (prior to 4.0.6). The vulnerability arises in the get1 path used by lftpget, where a server-provided filename from Content-Disposition is not properly validated, allowing a remote server to influence the destination filename and potentially overwrite...

CVE-2010-2251

The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted...

CVE-2010-2251

The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted...

CVE-2010-2251: Improper Input Validation

The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted...

Fedora Update for lftp FEDORA-2010-9819

The remote host is missing an update for the SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Fedora Update for lftp FEDORA-2010-9819

Check for the Version of lftp OpenVAS Vulnerability Test Fedora Update for lftp FEDORA-2010-9819 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms of...

Fedora 12 : lftp-4.0.8-1.fc12 (2010-9819)

CVE-2010-2251 lftp: multiple HTTP client download filename vulnerability Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

[SECURITY] Fedora 12 Update: lftp-4.0.8-1.fc12

LFTP is a sophisticated ftp/http file transfer program. Like bash, it has j ob control and uses the readline library for input. It has bookmarks, built-in mirroring, and can transfer several files in parallel. It is designed with reliability in mind...

openSUSE Security Update : lftp (openSUSE-SU-2010:0334-1)

This update of lftp improves the filename handling of downloaded files to avoid downloading arbitrary content to unexpected locations like .login. CVE-2010-2251 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE...