Description (CNA)
KGet 2.4.2 in KDE SC 4.0.0 through 4.4.3 does not properly request download confirmation from the user, which makes it easier for remote attackers to overwrite arbitrary files via a crafted metalink file.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- http://www.securityfocus.com/bid/40141
- http://www.ubuntu.com/usn/USN-938-1
- http://www.securityfocus.com/archive/1/511279/100/0/threaded
- http://www.securityfocus.com/archive/1/511294/100/0/threaded
- http://www.vupen.com/english/advisories/2010/1144
- http://secunia.com/secunia_research/2010-70/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/58629
- http://www.kde.org/info/security/advisory-20100513-1.txt
- http://www.vupen.com/english/advisories/2010/3096
- http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051692.html
- http://marc.info/?l=oss-security&m=127378789518426&w=2
- http://secunia.com/advisories/39528
- http://www.vupen.com/english/advisories/2010/1142
- http://securitytracker.com/id?1023984
- http://osvdb.org/64689
- http://secunia.com/advisories/39787
ADP enrichment
No English description supplied.
- http://www.securityfocus.com/bid/40141
- http://www.ubuntu.com/usn/USN-938-1
- http://www.securityfocus.com/archive/1/511279/100/0/threaded
- http://www.securityfocus.com/archive/1/511294/100/0/threaded
- http://www.vupen.com/english/advisories/2010/1144
- http://secunia.com/secunia_research/2010-70/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/58629
- http://www.kde.org/info/security/advisory-20100513-1.txt
- http://www.vupen.com/english/advisories/2010/3096
- http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051692.html
- http://marc.info/?l=oss-security&m=127378789518426&w=2
- http://secunia.com/advisories/39528
- http://www.vupen.com/english/advisories/2010/1142
- http://securitytracker.com/id?1023984
- http://osvdb.org/64689
- http://secunia.com/advisories/39787