CVE-2011-2524

libsoup < 2.35.4 - Path Traversal via Encoded Dot-Dot in URI

Title source: llm
STIX 2.1

Description

Directory traversal vulnerability in soup-uri.c in SoupServer in libsoup before 2.35.4 allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in a URI.

References (8)

Core 8
Core References
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/47299
Various Sources x_refsource_confirm
http://git.gnome.org/browse/libsoup/tree/NEWS
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063431.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2011-1102.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1025864
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2011/dsa-2369
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1181-1

Scores

EPSS 0.0085
EPSS Percentile 75.2%

Details

CWE
CWE-22
Status published
Products (50)
gnome/libsoup 2.0
gnome/libsoup 2.2
gnome/libsoup 2.2.0
gnome/libsoup 2.2.1
gnome/libsoup 2.2.2
gnome/libsoup 2.2.3
gnome/libsoup 2.2.4
gnome/libsoup 2.2.5
gnome/libsoup 2.2.6
gnome/libsoup 2.2.6.1
... and 40 more
Published Aug 31, 2011
Tracked Since Feb 18, 2026