Alerts This Week
Warning Icon 1 764
Alerts This Week
Warning Icon 1 764

Fedora 9 rb_libtorrent Update 2009-6619 Critical Directory Traversal

fedora
Calendar Grey June 26, 2009
Dist Fedora Esm H88
This patch resolves a cross-site scripting vulnerability in lib_http, improving safety for Debian 10 users.
This release adds an upstream patch to fix a directory traversal vulnerability which would allow a remote attacker to create or overwrite arbitrary files via a ".." (dot dot) and ...

Summary

rb_libtorrent is a C++ library that aims to be a good alternative to all

the other BitTorrent implementations around. It is a library and not a full

featured client, although it comes with a few working example clients.

Its main goals are to be very efficient (in terms of CPU and memory usage) as

well as being very easy to use both as a user and developer.

Update Information:

This release adds an upstream patch to fix a directory traversal vulnerability which would allow a remote attacker to create or overwrite arbitrary files via a ".." (dot dot) and partial relative pathname in a specially-crafted torrent. In addition to this, asio-devel has been added to the dependencies for the rb_libtorrent-devel package - a fix already applied to the Fedora 10, 11, and Development ("Rawhide") packages.

Topics%20covered

Topics Covered

security advisory critical Fedora directory traversal file overwrite

Change Log

* Sun Jun 14 2009 Peter Gordon - 0.12.1-2 - Apply backported upstream patch to fix CVE-2009-1760 (arbitrary file overwrite vulnerability): + 0.12-CVE-2009-1760.diff - Fixes security bug #505523. - Add asio-devel as runtime dependency for the devel subpackage (#478589)

References


[ 1 ] Bug #505523 - CVE-2009-1760 rb_libtorrent: arbitrary file overwrite vulnerability https://bugzilla.redhat.com/show_bug.cgi?id=505523

Update Instructions

This update can be installed with the "yum" update program. Use su -c 'yum update rb_libtorrent' at the command line. For more information, refer to "Managing Software with yum", available at .

Severity
critical
Lowest
Low
Medium
High
Critical

Name: rb_libtorrent
Product: Fedora 9
Version: 0.12.1
Release: 2.fc9
URL: https://www.rasterbar.com/products/libtorrent/
Summary: A C++ BitTorrent library aiming to be the best alternative

Topics%20covered

Topics Covered

security advisory critical Fedora directory traversal file overwrite

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here