CVE-2007-0159

2007-01-1000:00:00

ubuntu.com

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

0.024 Low

EPSS

Percentile

89.9%

JSON

Directory traversal vulnerability in the GeoIP_update_database_general
function in libGeoIP/GeoIPUpdate.c in GeoIP 1.4.0 allows remote malicious
update servers (possibly only update.maxmind.com) to overwrite arbitrary
files via a … (dot dot) in the database filename, which is returned by a
request to app/update_getfilename.

OSVersionArchitecturePackageVersionFilename
ubuntu6.06noarchgeoip< 1.3.14-2ubuntu0.1UNKNOWN
ubuntu6.10noarchgeoip< 1.3.17-1ubuntu0.1UNKNOWN
ubuntu7.04noarchgeoip< 1.3.17-1.1UNKNOWN