[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.64.1006091544190.15053@faron.mitre.org>
Date: Wed, 9 Jun 2010 15:47:42 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: [oCERT-2010-001] multiple http client unexpected
download filename vulnerability
On Wed, 9 Jun 2010, Marcus Meissner wrote:
> On Mon, May 17, 2010 at 01:03:22PM +0100, Daniele Bianco wrote:
>>
>> #2010-001 multiple http client unexpected download filename vulnerability
>>
>> Description:
>>
>> The lftp, wget and lwp-download applications are ftp/http clients and file
>> transfer tools supporting various network protocols. The lwp-download
>> script is shipped along with the libwww-perl library.
>
> Did anyone assign CVE ids for these?
Apologies to oCERT and everyone else for being so terrible at handling
this.
CVE-2010-2251 - lftp
CVE-2010-2252 - wget
CVE-2010-2253 - libwww-perl as used in lwp-download
- Steve
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
