Directory traversal vulnerability in soup-uri.c in SoupServer in libsoup before 2.35.4 allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in a URI.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libsoup2.4 | Jul 30, 2024 | Aug 31, 2011 |
| Gentoo Linux | — | Upgrade games-sports/racer-bin.Upgrade sys-cluster/resource-agents.Upgrade media-libs/xine-lib.Upgrade net-libs/webkit-gtk.Upgrade dev-util/qt-creator.Upgrade app-office/gnucash.Upgrade app-misc/ca-certificates.Upgrade net-analyzer/sflowtool.Upgrade dev-vcs/gitolite.Upgrade dev-util/oprofile.Upgrade gnome-base/gdm.Upgrade net-misc/vino.Upgrade dev-db/unixODBC.Upgrade sys-apps/shadow.Upgrade app-admin/syslog-ng.Upgrade media-sound/lastfmplayer.Upgrade net-misc/rsync.Upgrade dev-php/PEAR-Mail.Upgrade x11-apps/xrdb.Upgrade dev-libs/xmlsec.Upgrade net-libs/libsoup.Upgrade sys-fs/lvm2.Upgrade net-misc/mrouted.Upgrade dev-php/PEAR-PEAR.Upgrade media-libs/fmod. | Oct 30, 2017 | Aug 31, 2011 |
| Oracle Solaris | — | Upgrade library/libsoup to version 2.32.0-0.175.0.11.0.2.0 on Solaris 11.0 | May 29, 2017 | Aug 31, 2011 |
| Oracle_linux | — | Upgrade libsoup-develUpgrade libsoup | Oct 16, 2024 | Aug 31, 2011 |
| Suse | — | Upgrade libsoup-2_4-1-x86Upgrade libsoup-develUpgrade libsoup-2_4-1Upgrade libsoup-devel-32bitUpgrade libsoup-2_4-1-32bit | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libsoup2.4-1 | Nov 8, 2024 | Aug 31, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub