Debian DLA-2887-1 : lighttpd - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2887 advisory. - An issue was discovered in modaliasphysicalhandler in modalias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias...

CVE-2018-19052: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in modaliasphysicalhandler in modalias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific modalias configuration where the matched alias lacks a trailing '/' character, but the alias target...