CVE-2010-2253

lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a . dot character, which allows remote servers to create or overwrite files via 1 a 3xx redirect to a URL with a crafted filename or 2 a Content-Disposition header that suggests a crafted filename, and...

DEBIAN-CVE-2010-2253

lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a . dot character, which allows remote servers to create or overwrite files via 1 a 3xx redirect to a URL with a crafted filename or 2 a Content-Disposition header that suggests a crafted filename, and...

CVE-2010-2253

lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a . dot character, which allows remote servers to create or overwrite files via 1 a 3xx redirect to a URL with a crafted filename or 2 a Content-Disposition header that suggests a crafted filename, and...

Directory traversal

lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a . dot character, which allows remote servers to create or overwrite files via 1 a 3xx redirect to a URL with a crafted filename or 2 a Content-Disposition header that suggests a crafted filename, and...

CVE-2010-2253

CVE-2010-2253 affects libwww-perl’s lwp-download in versions before 5.835. A crafted filename via 3xx redirects or Content-Disposition can cause remote servers to create/overwrite dotfiles (e.g., in a home directory), potentially leading to arbitrary code execution. Affected component: lwp-downlo...

CVE-2010-2253

lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a . dot character, which allows remote servers to create or overwrite files via 1 a 3xx redirect to a URL with a crafted filename or 2 a Content-Disposition header that suggests a crafted filename, and...

CVE-2010-2253

lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a . dot character, which allows remote servers to create or overwrite files via 1 a 3xx redirect to a URL with a crafted filename or 2 a Content-Disposition header that suggests a crafted filename, and...

p5-libwww -- possibility to remote servers to create file with a .(dot) character

lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a .' dot character, which allows remote servers to create or overwrite files via a 3xx redirect to a URL with a crafted filename or a Content-Disposition header that suggests a crafted filename, and...

Mandriva Security Advisory MDVSA-2009:218-1 (w3c-libwww)

The remote host is missing an update to w3c-libwww announced via advisory MDVSA-2009:218-1. OpenVAS Vulnerability Test $Id: mdksa20092181.nasl 6573 2017-07-06 13:10:50Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:218-1 w3c-libwww Authors: Thomas Reinke Copyright: Copyright c...

Mandriva Security Advisory MDVSA-2009:218-1 (w3c-libwww)

The remote host is missing an update to w3c-libwww announced via advisory MDVSA-2009:218-1. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

CVE-2009-3720

The updatePosition function in lib/xmltokimpl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service application crash via an XML document with crafted UTF-8 sequences that trigger a buffer over-read,...

CVE-2009-3720

The updatePosition function in lib/xmltokimpl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service application crash via an XML document with crafted UTF-8 sequences that trigger a buffer over-read,...

CVE-2009-3720

The updatePosition function in lib/xmltokimpl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service application crash via an XML document with crafted UTF-8 sequences that trigger a buffer over-read,...

UBUNTU-CVE-2009-3720

The updatePosition function in lib/xmltokimpl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service application crash via an XML document with crafted UTF-8 sequences that trigger a buffer over-read,...

Mandrake Security Advisory MDVSA-2009:218 (w3c-libwww)

The remote host is missing an update to w3c-libwww announced via advisory MDVSA-2009:218. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

Mandrake Security Advisory MDVSA-2009:218 (w3c-libwww)

The remote host is missing an update to w3c-libwww announced via advisory MDVSA-2009:218. OpenVAS Vulnerability Test $Id: mdksa2009218.nasl 6573 2017-07-06 13:10:50Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:218 w3c-libwww Authors: Thomas Reinke Copyright: Copyright c 2009...

Mandriva Linux Security Advisory : w3c-libwww (MDVSA-2009:218-1)

A vulnerability was found in xmltokimpl.c expat that with specially crafted XML could be exploited and lead to a denial of service attack. Related to CVE-2009-2625 CVE-2009-3720. This update fixes this vulnerability. Update : Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers...

expat2 -- Parser crash with specially formatted UTF-8 sequences

CVE reports: The updatePosition function in lib/xmltokimpl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service application crash via an XML document with crafted UTF-8 sequences that trigger a buff...

openSUSE 10 Security Update : spamassassin (spamassassin-1904)

This update fixes the following security problem in SpamAssassin : - CVE-2006-2447: SpamAssassin when running with vpopmail and the paranoid -P switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop...

Low: w3c-libwww security and bug fix update

5.4.0-10.1.RHEL4.2 - fix for libwww's handling of multipart/byteranges content and possible stack overflow, CVE-2005-3183 - Resolves: rhbz169495 5.4.0-10.1.RHEL4.1 - fixed type in md5.h for 64bit bug 163664...