The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2011-706:01 advisory.

    Libsoup is an HTTP library implementation in C. It was originally part     of a SOAP (Simple Object Access Protocol) implementation called Soup, but     the SOAP and non-SOAP parts have now been split into separate packages.
    libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME     applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to     the Gtk+ programming model (a synchronous operation mode is also supported for those who want it).
    Security issues fixed with this release:
    CVE-2011-2524     Directory traversal vulnerability in soup-uri.c in SoupServer in libsoup before 2.35.4 allows remote     attackers to read arbitrary files via a %2e%2e (encoded dot dot) in a URI.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update of libsoup fixes a directory traversal attack that affect application using the library. CVE-2011-2524: CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)

The remote Solaris system is missing necessary patches to address security updates :

  - Directory traversal vulnerability in soup-uri.c in     SoupServer in libsoup before 2.35.4 allows remote     attackers to read arbitrary files via a %2e%2e (encoded     dot dot) in a URI. (CVE-2011-2524)

It was discovered that libsoup, a HTTP library implementation in C, is not properly validating input when processing requests made to SoupServer. A remote attacker can exploit this flaw to access system files via a directory traversal attack.

A vulnerability has been found and corrected in libsoup :

Directory traversal vulnerability in soup-uri.c in SoupServer in libsoup before 2.35.4 allows remote attackers to read arbitrary files via a \%2e\%2e (encoded dot dot) in a URI (CVE-2011-2524).

The updated packages have been patched to correct this issue.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:1102 advisory.

    libsoup is an HTTP client/library implementation for GNOME.

    A directory traversal flaw was found in libsoup's SoupServer. If an     application used SoupServer to implement an HTTP service, a remote attacker     who is able to connect to that service could use this flaw to access any     local files accessible to that application via a specially-crafted request.
    (CVE-2011-2524)

    All users of libsoup should upgrade to these updated packages, which     contain a backported patch to resolve this issue. All running applications     using libsoup's SoupServer must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that libsoup did not properly validate its input when processing SoupServer requests. A remote attacker could exploit this to access files via directory traversal.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
284079	MiracleLinux 4 : libsoup-2.28.2-1.AXS4.1 (AXSA:2011-706:01)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	high
75921	openSUSE Security Update : libsoup-2_4-1 (openSUSE-SU-2011:0875-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	medium
80677	Oracle Solaris Third-Party Patch Update : libsoup (cve_2011_2524_directory_traversal)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	medium
57509	Debian DSA-2369-1 : libsoup2.4 - insufficient input sanitization	Nessus	Debian Local Security Checks	2012/1/12	2021/1/11	medium
58475	Mandriva Linux Security Advisory : libsoup (MDVSA-2012:036)	Nessus	Mandriva Local Security Checks	2012/3/26	2021/1/6	medium
55724	RHEL 6 : libsoup (RHSA-2011:1102)	Nessus	Red Hat Local Security Checks	2011/7/29	2025/4/14	high
55731	Ubuntu 10.04 LTS / 10.10 / 11.04 : libsoup2.4 vulnerability (USN-1181-1)	Nessus	Ubuntu Local Security Checks	2011/7/29	2019/9/19	medium

检测

插件搜索

high

medium

medium

medium

medium

high

medium