CVE-2011-4675

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2011-4675

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2011-4675.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2011-4675

Published

2011-12-05T11:55:07Z

Modified

2024-11-21T01:32:45Z

Summary

[none]

Details

The pathname canonicalization functionality in io/filesystem/filesystem.cc in Widelands before 15.1 expands leading ~ (tilde) characters to home-directory pathnames but does not restrict use of these characters in strings received from the network, which might allow remote attackers to conduct absolute path traversal attacks and overwrite arbitrary files via a ~ in a pathname that is used for a file transfer in an Internet game, a different vulnerability than CVE-2011-1932.

References

Affected packages

Debian:11 / widelands

Package

Name: widelands
Purl: pkg:deb/debian/widelands?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:15-3

Ecosystem specific

{
    "urgency": "low"
}

Debian:12 / widelands

Package

Name: widelands
Purl: pkg:deb/debian/widelands?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:15-3

Ecosystem specific

{
    "urgency": "low"
}

Debian:13 / widelands

Package

Name: widelands
Purl: pkg:deb/debian/widelands?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:15-3

Ecosystem specific

{
    "urgency": "low"
}