bugGNU Wget - Bugs: bug #29958, security risk of unexpected...

 
 

bug #29958: security risk of unexpected download filenames

Submitted by:  Giuseppe Scrivano <gscrivano>
Submitted on:  Tue 25 May 2010 06:08:56 PM UTC  
 
Category: Program LogicSeverity: 4 - Important
Priority: 5 - NormalStatus: Fixed
Privacy: PublicAssigned to: Giuseppe Scrivano <gscrivano>
Originator Name: Open/Closed: Closed
Release: NoneOperating System: None
Reproducibility: Every TimeFixed Release: 1.12.1
Planned Release: NoneRegression: None
Work Required: NonePatch Included: Yes

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 17 Aug 2010 10:01:45 AM UTC, comment #4:

this bug is fixed in the bazaar repository with the commit 2409.

Sorry but I forgot to update the status of this report.

Giuseppe Scrivano <gscrivano>
Project AdministratorIn charge of this item.
Tue 17 Aug 2010 04:50:23 AM UTC, comment #3:

attached is a patch against 0.11, which needs refreshed to apply against 0.12.

(file #21240)

Anonymous
Thu 29 Jul 2010 03:23:13 PM UTC, comment #2:

sorry. forget the last comment.

Noël Köthe <nok>
Thu 29 Jul 2010 03:08:58 PM UTC, comment #1:

as far as I can see this (have both bugs in the Debian BTS, too) is the same report as:

bug #29898: Unterminated C string in http_atotm()

Noël Köthe <nok>
Tue 25 May 2010 06:08:56 PM UTC, original submission:

more information here:

http://www.ocert.org/advisories/ocert-2010-001.html

Giuseppe Scrivano <gscrivano>
Project AdministratorIn charge of this item.

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #21240:  server-file-name.dpatch added by None (10KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by nok (Posted a comment)
  • -unavailable- added by gscrivano (Submitted the item)
  •  

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 17 Aug 2010 10:01:45 AM UTCgscrivanoStatusNeeds Investigation=>Fixed
      Assigned toNone=>gscrivano
      Open/ClosedOpen=>Closed
      Fixed ReleaseNone=>1.12.1
      Patch IncludedNone=>Yes
    Tue 17 Aug 2010 04:50:23 AM UTCNoneAttached File-=>Added server-file-name.dpatch, #21240

    Back to the top


    Powered by Savane 3.1-cleanup1