Ubuntu
lighttpd package

  1. Feisty (7.04)
  2. Bug #200987
  3. Comment #11

Comment 11 for bug 200987

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package lighttpd - 1.4.13-9ubuntu4.5

---------------
lighttpd (1.4.13-9ubuntu4.5) feisty-security; urgency=low

  * SECURITY UPDATE: (LP: #200987)
   + debian/patches/91_CVE-2008-1270.dpatch
    - mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set,
      uses a default of $HOME, which might allow remote attackers to read arbitrary
      files, as demonstrated by accessing the ~nobody directory.
  * References
   + http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1270
   + http://trac.lighttpd.net/trac/ticket/1587
   + http://trac.lighttpd.net/trac/changeset/2120

 -- Emanuele Gentili <email address hidden> Tue, 11 Mar 2008 14:51:11 +0100