Deskripsi CVE

Directory traversal vulnerability in the KGetMetalink::File::isValidNameAttr function in ui/metalinkcreator/metalinker.cpp in KGet in KDE SC 4.6.2 and earlier allows remote attackers to create arbitrary files via a .. (dot dot) in the name attribute of a file element in a metalink file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-1000.

Informasi CVE

Kelemahan Terkait

CWE-ID	Nama Kelemahan	Sumber
CWE-22	Improper Limitation of a Pathname to a Restricted Directory The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Metrik

Metrik	Skor	Tingkat keparahan	CVSS Vektor	Sumber
V2	5.8		AV:N/AC:M/Au:N/C:N/I:P/A:P	nvd@nist.gov

EPSS

EPSS adalah model penilaian yang memprediksi kemungkinan suatu kerentanan dieksploitasi.

Skor EPSS

Model EPSS menghasilkan skor probabilitas antara 0 dan 1 (0 hingga 100%). Semakin tinggi skor, semakin besar probabilitas bahwa suatu kerentanan akan dieksploitasi.

Persentil EPSS

Persentil digunakan untuk meranking CVE berdasarkan skor EPSS mereka. Misalnya, CVE di persentil ke-95 berdasarkan skor EPSS-nya lebih mungkin dieksploitasi daripada 95% CVE lainnya. Dengan demikian, persentil digunakan untuk membandingkan skor EPSS suatu CVE dengan CVE lainnya.

EPSS First.org

Produk yang Disebutkan

Konfigurasi 0

Kde>>Kde_sc >> Version Hingga (termasuk) 4.6.2

Kde>>Kde_sc >> Version 2.2.0

Kde>>Kde_sc >> Version 3.5.10

Kde>>Kde_sc >> Version 4.0.0

Kde>>Kde_sc >> Version 4.0.1

Kde>>Kde_sc >> Version 4.0.2

Kde>>Kde_sc >> Version 4.0.3

Kde>>Kde_sc >> Version 4.0.4

Kde>>Kde_sc >> Version 4.0.5

Kde>>Kde_sc >> Version 4.1.0

Kde>>Kde_sc >> Version 4.1.1

Kde>>Kde_sc >> Version 4.1.2

Kde>>Kde_sc >> Version 4.1.3

Kde>>Kde_sc >> Version 4.1.4

Kde>>Kde_sc >> Version 4.1.80

Kde>>Kde_sc >> Version 4.1.85

Kde>>Kde_sc >> Version 4.1.96

Kde>>Kde_sc >> Version 4.2

Kde>>Kde_sc >> Version 4.2.0

Kde>>Kde_sc >> Version 4.2.1

Kde>>Kde_sc >> Version 4.2.2

Kde>>Kde_sc >> Version 4.2.3

Kde>>Kde_sc >> Version 4.2.4

Kde>>Kde_sc >> Version 4.3.0

Kde>>Kde_sc >> Version 4.3.1

Kde>>Kde_sc >> Version 4.3.2

Kde>>Kde_sc >> Version 4.3.3

Kde>>Kde_sc >> Version 4.3.4

Kde>>Kde_sc >> Version 4.3.5

Kde>>Kde_sc >> Version 4.4.0

Kde>>Kde_sc >> Version 4.4.1

Kde>>Kde_sc >> Version 4.4.2

Kde>>Kde_sc >> Version 4.4.3

Kde>>Kde_sc >> Version 4.4.4

Kde>>Kde_sc >> Version 4.4.5

Kde>>Kde_sc >> Version 4.5.0

Kde>>Kde_sc >> Version 4.5.1

Kde>>Kde_sc >> Version 4.5.2

Kde>>Kde_sc >> Version 4.5.3

Kde>>Kde_sc >> Version 4.5.4

Kde>>Kde_sc >> Version 4.5.5

Kde>>Kde_sc >> Version 4.6

Kde>>Kde_sc >> Version 4.6.0

Kde>>Kde_sc >> Version 4.6.1

Referensi

https://launchpad.net/bugs/757526
Tags : x_refsource_CONFIRM

http://websvn.kde.org/branches/KDE/4.4/kdenetwork/kget/ui/metalinkcreator/metalinker.cpp?r1=1227468&r2=1227467&pathrev=1227468
Tags : x_refsource_CONFIRM

http://websvn.kde.org/branches/KDE/4.6/kdenetwork/kget/ui/metalinkcreator/metalinker.cpp?r1=1227471&r2=1227470&pathrev=1227471
Tags : x_refsource_CONFIRM

http://secunia.com/advisories/44124
Tags : third-party-advisory, x_refsource_SECUNIA

http://openwall.com/lists/oss-security/2011/04/15/9
Tags : mailing-list, x_refsource_MLIST

http://www.vupen.com/english/advisories/2011/1135
Tags : vdb-entry, x_refsource_VUPEN

http://www.redhat.com/support/errata/RHSA-2011-0465.html
Tags : vendor-advisory, x_refsource_REDHAT

http://www.vupen.com/english/advisories/2011/1019
Tags : vdb-entry, x_refsource_VUPEN

http://secunia.com/advisories/44329
Tags : third-party-advisory, x_refsource_SECUNIA

http://websvn.kde.org/branches/KDE/4.5/kdenetwork/kget/ui/metalinkcreator/metalinker.cpp?r1=1227469&r2=1227468&pathrev=1227469
Tags : x_refsource_CONFIRM

http://www.vupen.com/english/advisories/2011/1021
Tags : vdb-entry, x_refsource_VUPEN

http://www.mandriva.com/security/advisories?name=MDVSA-2011:081
Tags : vendor-advisory, x_refsource_MANDRIVA

http://www.ubuntu.com/usn/usn-1114-1/
Tags : vendor-advisory, x_refsource_UBUNTU

https://exchange.xforce.ibmcloud.com/vulnerabilities/66826
Tags : vdb-entry, x_refsource_XF

https://bugzilla.redhat.com/show_bug.cgi?id=697042
Tags : x_refsource_CONFIRM

Tanggal	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	3.41%	–	–
2022-02-20	–	–	3.41%	–	–
2022-04-03	–	–	3.41%	–	–
2022-06-26	–	–	3.41%	–	–
2023-02-26	–	–	3.41%	–	–
2023-03-12	–	–	–	0.51%	–
2023-08-20	–	–	–	0.51%	–
2024-02-11	–	–	–	0.51%	–
2024-03-31	–	–	–	0.49%	–
2024-06-02	–	–	–	0.49%	–
2024-06-02	–	–	–	0.49%	–
2024-08-25	–	–	–	0.49%	–
2024-09-22	–	–	–	0.49%	–
2024-10-06	–	–	–	0.49%	–
2024-10-13	–	–	–	0.49%	–
2024-12-22	–	–	–	0.49%	–
2025-01-19	–	–	–	0.49%	–
2025-03-18	–	–	–	–	0.71%
2025-03-30	–	–	–	–	0.71%
2025-04-15	–	–	–	–	0.71%
2025-05-31	–	–	–	–	0.85%
2025-11-18	–	–	–	–	0.85%
2025-11-21	–	–	–	–	0.85%
2026-02-22	–	–	–	–	0.85%

Tanggal	Persentil
2022-02-06	66%
2022-02-20	67%
2022-04-03	83%
2022-06-26	84%
2023-02-26	85%
2023-03-12	73%
2023-08-20	74%
2024-02-11	76%
2024-03-31	76%
2024-06-02	76%
2024-06-02	76%
2024-08-25	77%
2024-09-22	76%
2024-10-06	76%
2024-10-13	77%
2024-12-22	76%
2025-01-19	76%
2025-03-18	71%
2025-03-30	7%
2025-04-15	71%
2025-05-31	74%
2025-11-18	73%
2025-11-21	74%
2026-02-22	75%

CVE-2011-1586 : Detail

CVE-2011-1586