CVE-2010-1512

Directory traversal vulnerability in aria2 before 1.9.3 allows remote attackers to create arbitrary files via directory traversal sequences in the name attribute of a file element in a metalink file.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
flexeraCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 68%
VendorProductVersion
tatsuhiro_tsujikawaaria2
𝑥
≤ 1.9.2
tatsuhiro_tsujikawaaria2
0.1.0
tatsuhiro_tsujikawaaria2
0.2.0
tatsuhiro_tsujikawaaria2
0.2.1
tatsuhiro_tsujikawaaria2
0.2.1\+1
tatsuhiro_tsujikawaaria2
0.2.1\+2
tatsuhiro_tsujikawaaria2
0.3.0
tatsuhiro_tsujikawaaria2
0.3.1
tatsuhiro_tsujikawaaria2
0.3.1\+1
tatsuhiro_tsujikawaaria2
0.3.1\+2
tatsuhiro_tsujikawaaria2
0.3.2
tatsuhiro_tsujikawaaria2
0.4.0
tatsuhiro_tsujikawaaria2
0.4.1
tatsuhiro_tsujikawaaria2
0.5.0
tatsuhiro_tsujikawaaria2
0.5.0\+1
tatsuhiro_tsujikawaaria2
0.5.0\+2
tatsuhiro_tsujikawaaria2
0.5.1
tatsuhiro_tsujikawaaria2
0.5.2
tatsuhiro_tsujikawaaria2
0.6.0
tatsuhiro_tsujikawaaria2
0.6.0\+1
tatsuhiro_tsujikawaaria2
0.7.0
tatsuhiro_tsujikawaaria2
0.7.1
tatsuhiro_tsujikawaaria2
0.7.2
tatsuhiro_tsujikawaaria2
0.7.3
tatsuhiro_tsujikawaaria2
0.8.0
tatsuhiro_tsujikawaaria2
0.8.1
tatsuhiro_tsujikawaaria2
0.9.0
tatsuhiro_tsujikawaaria2
0.10.0
tatsuhiro_tsujikawaaria2
0.10.0\+1
tatsuhiro_tsujikawaaria2
0.10.1
tatsuhiro_tsujikawaaria2
0.10.2
tatsuhiro_tsujikawaaria2
0.10.2\+1
tatsuhiro_tsujikawaaria2
0.11.0
tatsuhiro_tsujikawaaria2
0.11.1
tatsuhiro_tsujikawaaria2
0.11.1\+1
tatsuhiro_tsujikawaaria2
0.11.2
tatsuhiro_tsujikawaaria2
0.11.3
tatsuhiro_tsujikawaaria2
0.11.4
tatsuhiro_tsujikawaaria2
0.11.5
tatsuhiro_tsujikawaaria2
0.12.0
tatsuhiro_tsujikawaaria2
0.12.1
tatsuhiro_tsujikawaaria2
0.13.0
tatsuhiro_tsujikawaaria2
0.13.0\+1
tatsuhiro_tsujikawaaria2
0.13.1
tatsuhiro_tsujikawaaria2
0.13.1\+1
tatsuhiro_tsujikawaaria2
0.13.1\+2
tatsuhiro_tsujikawaaria2
0.13.2
tatsuhiro_tsujikawaaria2
0.13.2\+1
tatsuhiro_tsujikawaaria2
0.14.0
tatsuhiro_tsujikawaaria2
0.14.0\+1
tatsuhiro_tsujikawaaria2
0.15.0
tatsuhiro_tsujikawaaria2
0.15.1
tatsuhiro_tsujikawaaria2
0.15.1\+1
tatsuhiro_tsujikawaaria2
0.15.1\+2
tatsuhiro_tsujikawaaria2
0.15.2
tatsuhiro_tsujikawaaria2
0.15.3
tatsuhiro_tsujikawaaria2
0.16.0
tatsuhiro_tsujikawaaria2
0.16.1
tatsuhiro_tsujikawaaria2
0.16.2
tatsuhiro_tsujikawaaria2
1.0.0
tatsuhiro_tsujikawaaria2
1.0.1
tatsuhiro_tsujikawaaria2
1.1.0
tatsuhiro_tsujikawaaria2
1.1.1
tatsuhiro_tsujikawaaria2
1.1.2
tatsuhiro_tsujikawaaria2
1.2.0
tatsuhiro_tsujikawaaria2
1.3.0
tatsuhiro_tsujikawaaria2
1.3.1
tatsuhiro_tsujikawaaria2
1.3.2
tatsuhiro_tsujikawaaria2
1.3.3
tatsuhiro_tsujikawaaria2
1.4.0
tatsuhiro_tsujikawaaria2
1.4.1
tatsuhiro_tsujikawaaria2
1.5.0
tatsuhiro_tsujikawaaria2
1.5.0b\+20090716:b
tatsuhiro_tsujikawaaria2
1.5.1
tatsuhiro_tsujikawaaria2
1.5.2
tatsuhiro_tsujikawaaria2
1.6.0
tatsuhiro_tsujikawaaria2
1.6.1
tatsuhiro_tsujikawaaria2
1.6.2
tatsuhiro_tsujikawaaria2
1.6.3
tatsuhiro_tsujikawaaria2
1.7.0
tatsuhiro_tsujikawaaria2
1.7.1
tatsuhiro_tsujikawaaria2
1.7.2
tatsuhiro_tsujikawaaria2
1.8.0
tatsuhiro_tsujikawaaria2
1.8.1
tatsuhiro_tsujikawaaria2
1.8.2
tatsuhiro_tsujikawaaria2
1.8.3
tatsuhiro_tsujikawaaria2
1.9.0
tatsuhiro_tsujikawaaria2
1.9.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
aria2
bullseye
1.35.0-3
fixed
bookworm
1.36.0-1
fixed
sid
1.37.0+debian-2
fixed
trixie
1.37.0+debian-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
aria2
saucy
not-affected
raring
not-affected
quantal
not-affected
precise
not-affected
oneiric
not-affected
natty
not-affected
maverick
not-affected
lucid
ignored
karmic
ignored
jaunty
ignored
hardy
ignored
dapper
dne
Common Weakness Enumeration
References
http://downloads.sourceforge.net/project/aria2/stable/aria2-1.9.3/NEWS
http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041753.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041754.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041758.html
http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html
http://secunia.com/advisories/39529
http://secunia.com/advisories/39872
http://secunia.com/advisories/42906
http://secunia.com/secunia_research/2010-71/
http://security.gentoo.org/glsa/glsa-201101-04.xml
http://www.debian.org/security/2010/dsa-2047
http://www.mandriva.com/security/advisories?name=MDVSA-2010:106
http://www.osvdb.org/64592
http://www.securityfocus.com/archive/1/511280/100/0/threaded
http://www.securityfocus.com/bid/40142
http://www.vupen.com/english/advisories/2010/1228
http://www.vupen.com/english/advisories/2010/1229
http://www.vupen.com/english/advisories/2011/0116
http://downloads.sourceforge.net/project/aria2/stable/aria2-1.9.3/NEWS
http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041753.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041754.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041758.html
http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html
http://secunia.com/advisories/39529
http://secunia.com/advisories/39872
http://secunia.com/advisories/42906
http://secunia.com/secunia_research/2010-71/
http://security.gentoo.org/glsa/glsa-201101-04.xml
http://www.debian.org/security/2010/dsa-2047
http://www.mandriva.com/security/advisories?name=MDVSA-2010:106
http://www.osvdb.org/64592
http://www.securityfocus.com/archive/1/511280/100/0/threaded
http://www.securityfocus.com/bid/40142
http://www.vupen.com/english/advisories/2010/1228
http://www.vupen.com/english/advisories/2010/1229
http://www.vupen.com/english/advisories/2011/0116