Description
Directory traversal vulnerability in soup-uri.c in SoupServer in libsoup before 2.35.4 allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in a URI.
Affected products
- GNOME / libsoup2.35.3
- GNOME / libsoup2.0 – 2.0
- GNOME / libsoup2.2 – 2.2
- GNOME / libsoup2.2.0 – 2.2.0
- GNOME / libsoup2.2.1 – 2.2.1
- GNOME / libsoup2.2.2 – 2.2.2
- GNOME / libsoup2.2.3 – 2.2.3
- GNOME / libsoup2.2.4 – 2.2.4
- GNOME / libsoup2.2.5 – 2.2.5
- GNOME / libsoup2.2.6 – 2.2.6
- GNOME / libsoup2.2.6.1 – 2.2.6.1
- GNOME / libsoup2.2.7 – 2.2.7
- GNOME / libsoup2.2.91 – 2.2.91
- GNOME / libsoup2.2.92 – 2.2.92
- GNOME / libsoup2.2.93 – 2.2.93
- GNOME / libsoup2.2.94 – 2.2.94
- GNOME / libsoup2.2.95.1 – 2.2.95.1
- GNOME / libsoup2.2.96 – 2.2.96
- GNOME / libsoup2.2.97 – 2.2.97
- GNOME / libsoup2.2.98 – 2.2.98
- GNOME / libsoup2.2.99 – 2.2.99
- GNOME / libsoup2.2.100 – 2.2.100
- GNOME / libsoup2.2.101 – 2.2.101
- GNOME / libsoup2.2.102 – 2.2.102
- GNOME / libsoup2.2.103 – 2.2.103
- GNOME / libsoup2.2.104 – 2.2.104
- GNOME / libsoup2.3.0.1 – 2.3.0.1
- GNOME / libsoup2.3.2 – 2.3.2
- GNOME / libsoup2.3.4 – 2.3.4
- GNOME / libsoup2.4.0 – 2.4.0
- GNOME / libsoup2.4.1 – 2.4.1
- GNOME / libsoup2.23.1 – 2.23.1
- GNOME / libsoup2.23.6 – 2.23.6
- GNOME / libsoup2.23.91 – 2.23.91
- GNOME / libsoup2.23.92 – 2.23.92
- GNOME / libsoup2.24.0.1 – 2.24.0.1
- GNOME / libsoup2.24.1 – 2.24.1
- GNOME / libsoup2.25.2 – 2.25.2
- GNOME / libsoup2.25.3 – 2.25.3
- GNOME / libsoup2.25.4 – 2.25.4
- GNOME / libsoup2.25.5 – 2.25.5
- GNOME / libsoup2.25.91 – 2.25.91
- GNOME / libsoup2.26.0 – 2.26.0
- GNOME / libsoup2.26.1 – 2.26.1
- GNOME / libsoup2.27.1 – 2.27.1
- GNOME / libsoup2.27.2 – 2.27.2
- GNOME / libsoup2.27.4 – 2.27.4
- GNOME / libsoup2.27.5 – 2.27.5
- GNOME / libsoup2.27.90 – 2.27.90
- GNOME / libsoup2.27.91 – 2.27.91
- GNOME / libsoup2.27.92 – 2.27.92
- GNOME / libsoup2.28.0 – 2.28.0
- GNOME / libsoup2.28.1 – 2.28.1
- GNOME / libsoup2.29.3 – 2.29.3
- GNOME / libsoup2.29.5 – 2.29.5
- GNOME / libsoup2.29.6 – 2.29.6
- GNOME / libsoup2.29.90 – 2.29.90
- GNOME / libsoup2.29.91 – 2.29.91
- GNOME / libsoup2.30.0 – 2.30.0
- GNOME / libsoup2.30.1 – 2.30.1
- GNOME / libsoup2.31.2 – 2.31.2
- GNOME / libsoup2.31.6 – 2.31.6
- GNOME / libsoup2.31.90 – 2.31.90
- GNOME / libsoup2.31.92 – 2.31.92
- GNOME / libsoup2.32.0 – 2.32.0
- GNOME / libsoup2.32.1 – 2.32.1
- GNOME / libsoup2.32.2 – 2.32.2
- GNOME / libsoup2.33.4 – 2.33.4
- GNOME / libsoup2.33.5 – 2.33.5
- GNOME / libsoup2.33.6 – 2.33.6
- GNOME / libsoup2.33.90 – 2.33.90
- GNOME / libsoup2.33.92 – 2.33.92
- GNOME / libsoup2.34.0 – 2.34.0
- GNOME / libsoup2.34.1 – 2.34.1
References
- VENDOR_ADVISORYhttp://secunia.com/advisories/47299
- MISChttp://git.gnome.org/browse/libsoup/tree/NEWS
- MAILING_LISThttp://lists.fedoraproject.org/pipermail/package-announce/2011-August/063431.html
- MISChttp://www.redhat.com/support/errata/RHSA-2011-1102.html
- MISChttp://www.securitytracker.com/id?1025864
- VENDOR_ADVISORYhttp://www.debian.org/security/2011/dsa-2369
- MISChttps://bugzilla.gnome.org/show_bug.cgi?id=653258
- VENDOR_ADVISORYhttp://www.ubuntu.com/usn/USN-1181-1
Updated 8m ago · 8 sources