CVE-2010-2253: gisle_aas libwww-perl Improper Input Validation
Vulnerability summary
CVE-2010-2253 is a medium (CVSS 6.8) Improper Input Validation vulnerability in gisle_aas libwww-perl. EPSS estimates a 3.29% chance of exploitation in the next 30 days, higher than 88.4% of scored vulnerabilities.
Timeline
- 06-07-2010PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a . (dot) character, which allows remote servers to create or overwrite files via (1) a 3xx redirect to a URL with a crafted filename or (2) a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
3.29%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
No change 0.00 pp
From 3.29% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- libwww-perl< 5.835-1
Gisle_aas1 product
- libwww-perl0.01 | 0.02 | 0.03 | 0.04 | 5.00 | 5.01 | 5.02 | 5.03 | 5.04 | 5.05 | 5.06 | 5.07 | 5.08 | 5.09 | 5.10 | 5.11 | 5.12 | 5.13 | 5.14 | 5.15 | 5.16 | 5.17 | 5.18 | 5.18_03 | 5.18_04 | 5.18_05 | 5.19 | 5.20 | 5.21 | 5.22 | 5.30 | 5.31 | 5.32 | 5.33 | 5.34 | 5.35 | 5.36 | 5.41 | 5.42 | 5.43 | 5.44 | 5.45 | 5.46 | 5.47 | 5.48 | 5.49 | 5.50 | 5.51 | 5.52 | 5.53 | 5.53_90 | 5.53_91 | 5.53_92 | 5.53_93 | 5.53_94 | 5.53_95 | 5.53_96 | 5.53_97 | 5.60 | 5.61 | 5.62 | 5.63 | 5.64 | 5.65 | 5.66 | 5.67 | 5.68 | 5.69 | 5.70 | 5.71 | 5.72 | 5.73 | 5.74 | 5.75 | 5.76 | 5.77 | 5.78 | 5.79 | 5.800 | 5.801 | 5.802 | 5.803 | 5.804 | 5.805 | 5.806 | 5.807 | 5.808 | 5.810 | 5.811 | 5.812 | 5.813 | 5.814 | 5.815 | 5.816 | 5.817 | 5.818 | 5.819 | 5.820 | 5.821 | 5.822 | 5.823 | 5.824 | 5.825 | 5.826 | 5.827 | 5.828 | 5.829 | 5.830 | 5.831 | 5.832 | 5.833 | 5b5 | 5b6 | 5b7 | 5b8 | 5b9 | 5b10 | 5b11 | 5b12 | 5b13
Search.cpan1 product
- libwww-perl≤ 5.834 | 5.40_01
3 vendors · 3 products
References
11 links- bugzilla.redhat.com/show_bug.cgi?id=602800X Refsource CONFIRM
- cpansearch.perl.org/src/GAAS/libwww-perl-5.836/ChangesX Refsource CONFIRM
- lists.fedoraproject.org/pipermail/package-announce/2010-November/050245.htmlVendor AdvisoryX Refsource FEDORA
- www.ocert.org/advisories/ocert-2010-001.htmlX Refsource MISC
- lists.fedoraproject.org/pipermail/package-announce/2010-November/050232.htmlVendor AdvisoryX Refsource FEDORA
- bugzilla.redhat.com/show_bug.cgi?id=591580X Refsource CONFIRM
