PRIOn knowledge basePRION:CVE-2010-1511Cross site request forgery (csrf)
KGet 2.4.2 in KDE SC 4.0.0 through 4.4.3 does not properly request download confirmation from the user, which makes it easier for remote attackers to overwrite arbitrary files via a crafted metalink file.
| CPE | Name | Operator | Version |
|---|---|---|---|
| kde_sc | eq | 2.2.0 | |
| kde_sc | eq | 3.5.10 | |
| kde_sc | eq | 4.0.0 alpha2 | |
| kde_sc | eq | 4.0.0 rc1 | |
| kde_sc | eq | 4.0.0 beta4 | |
| kde_sc | eq | 4.0.0 beta3 | |
| kde_sc | eq | 4.0.0 | |
| kde_sc | eq | 4.0.0 alpha1 | |
| kde_sc | eq | 4.0.0 rc2 | |
| kde_sc | eq | 4.0.0 beta2 |
References
osvdb.org/64689
secunia.com/advisories/39528
secunia.com/advisories/39787
secunia.com/secunia_research/2010-70/
securitytracker.com/id?1023984
www.kde.org/info/security/advisory-20100513-1.txt
www.securityfocus.com/archive/1/511279/100/0/threaded
www.securityfocus.com/archive/1/511294/100/0/threaded
www.securityfocus.com/bid/40141
www.ubuntu.com/usn/USN-938-1
www.vupen.com/english/advisories/2010/1142
www.vupen.com/english/advisories/2010/1144
www.vupen.com/english/advisories/2010/3096
exchange.xforce.ibmcloud.com/vulnerabilities/58629
lists.fedoraproject.org/pipermail/package-announce/2010-November/051692.html
marc.info/?l=oss-security&m=127378789518426&w=2
Related
