CVE catalog

CVE-2010-2253

libwww-perl: CVE-2010-2253

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
3.29% · Oct 25, 2026

lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a . (dot) character, which allows remote servers to create or overwrite files via (1) a 3xx redirect to a URL with a crafted filename or (2) a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibwww-perlsid6.83-1fixed
Debianlibwww-perlforky6.83-1fixed
Debianlibwww-perltrixie6.78-1fixed
Debianlibwww-perlbookworm6.68-1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibwww-perlsourcesid5.835-1lowNot reportedNot reported
Debianlibwww-perlsourceforky5.835-1lowNot reportedNot reported
Debianlibwww-perlsourcetrixie5.835-1lowNot reportedNot reported
Debianlibwww-perlsourcebookworm5.835-1lowNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libwww-perl]Fixed
    Details (2)

    • 6.68-1 · all · bookworm

      Fixed · Fixed: 5.835-1

      dsa · libwww-perl · debian · bookworm; dsa · libwww-perl · debian · 12

    • 6.68-1 · all · bookworm

      Fixed · Fixed: 5.835-1

      dsa · libwww-perl · debian · bookworm; dsa · libwww-perl · debian · 12

[Debian 13 (Trixie)]

  • [libwww-perl]Fixed
    Details (2)

    • 6.78-1 · all · trixie

      Fixed · Fixed: 5.835-1

      dsa · libwww-perl · debian · 13

    • 6.78-1 · all · trixie

      Fixed · Fixed: 5.835-1

      dsa · libwww-perl · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]