libdigidoc: file overwrite [LWN.net]

Package(s):

libdigidoc

CVE #(s):

CVE-2013-5648

Created:

September 3, 2013

Updated:

September 5, 2013

Description:

From the CVE entry:

Absolute path traversal vulnerability in the handleStartDataFile function in DigiDocSAXParser.c in libdigidoc 3.6.0.0, as used in ID-software before 3.7.2 and other products, allows remote attackers to overwrite arbitrary files via a filename beginning with / (slash) or \ (backslash) in a DDOC file.

Alerts:

Mageia	MGASA-2013-0268	2013-08-30
Mandriva	MDVSA-2013:225	2013-09-02

(Log in to post comments)