Solution
Please Install the Updated Packages.
Insight
A vulnerability has been discovered and fixed in kget (kdenetwork4):
The name attribute of the file element of metalink files is not properly sanitized before being used to download files. If a user is tricked into downloading from a specially crafted metalink file, this can be exploited to download files to directories outside of the intended download directory via directory traversal attacks (CVE-2010-1000).
Packages for 2009.0 are provided due to the Extended Maintenance Program.
The corrected packages solves these problems.
Affected
kdenetwork4 on Mandriva Linux 2009.0,
Mandriva Linux 2009.0/X86_64,
Mandriva Linux 2009.1,
Mandriva Linux 2009.1/X86_64,
Mandriva Linux 2010.0,
Mandriva Linux 2010.0/X86_64
Severity
Classification
-
CVE CVE-2010-1000 -
CVSS Base Score: 5.8
AV:N/AC:M/Au:N/C:N/I:P/A:P
Related Vulnerabilities