bugGNU Wget - Bugs: bug #29958, security risk of unexpected...

 
 

bug #29958: security risk of unexpected download filenames

Submitter:  Giuseppe Scrivano <gscrivano>
Submitted:  Tue 25 May 2010 06:08:56 PM UTC
   
 
Category:  Program Logic Severity:  4 - Important
Priority:  5 - Normal Status:  Fixed
Privacy:  Public Assigned to:  gscrivano
Originator Name:  Open/Closed:  Closed
Release:  None Operating System:  None
Reproducibility:  Every Time Fixed Release:  1.12.1
Planned Release:  None Regression:  None
Work Required:  None Patch Included:  Yes
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 17 Aug 2010 10:01:45 AM UTC, comment #4: 

this bug is fixed in the bazaar repository with the commit 2409.

Sorry but I forgot to update the status of this report.


Giuseppe Scrivano <gscrivano>
Group administrator
Tue 17 Aug 2010 04:50:23 AM UTC, comment #3: 

attached is a patch against 0.11, which needs refreshed to apply against 0.12.

(file #21240)

Anonymous
Thu 29 Jul 2010 03:23:13 PM UTC, comment #2: 

sorry. forget the last comment.

Noël Köthe <nok>
Thu 29 Jul 2010 03:08:58 PM UTC, comment #1: 

as far as I can see this (have both bugs in the Debian BTS, too) is the same report as:

bug #29898: Unterminated C string in http_atotm()

Noël Köthe <nok>
Tue 25 May 2010 06:08:56 PM UTC, original submission:  
Giuseppe Scrivano <gscrivano>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #21240:  server-file-name.dpatch added by None (10KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by nok (Posted a comment)
  • -email is unavailable- added by gscrivano (Submitted the item)
  •  

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-08-17 gscrivano StatusNeeds Investigation Fixed
        Assigned toNone gscrivano
        Open/ClosedOpen Closed
        Fixed ReleaseNone 1.12.1
        Patch IncludedNone Yes
    2010-08-17 None Attached File- Added server-file-name.dpatch, #21240

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code