A vulnerability has been found in Deluge which could result in XSS.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-p2p/deluge | * | < 2.1.1 | >= 2.1.1 |
Deluge is a BitTorrent client.
Deluge does not sufficiently sanitize crafted torrent file data, leading to the application interpreting untrusted data as HTML.
An attacker can achieve XSS via a crafted torrent file.
There is no known workaround at this time.
All Deluge users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-p2p/deluge-2.1.1"
A vulnerability in Deluge might allow remote attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-p2p/deluge | * | < 1.3.14 | >= 1.3.14 |
Deluge is a BitTorrent client.
A CSRF vulnerability was discovered in the web UI of Deluge.
A remote attacker could entice a user currently logged in into Deluge web UI to visit a malicious web page which uses forged requests to make Deluge download and install a Deluge plug-in provided by the attacker. The plug-in can then execute arbitrary code as the user running Deluge.
There is no known workaround at this time.
All Deluge users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-p2p/deluge-1.3.14"
A directory traversal vulnerability in Rasterbar libtorrent might allow a remote attacker to overwrite arbitrary files.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-libs/rb_libtorrent | * | < 0.13-r1 | >= 0.13-r1 |
| net-p2p/deluge | * | < 1.1.9 | >= 1.1.9 |
Rasterbar libtorrent is a C++ BitTorrent implementation focusing on efficiency and scalability. Deluge is a BitTorrent client that ships a copy of libtorrent.
census reported a directory traversal vulnerability in src/torrent_info.cpp that can be triggered via .torrent files.
A remote attacker could entice a user or automated system using Rasterbar libtorrent to load a specially crafted BitTorrent file to create or overwrite arbitrary files using dot dot sequences in filenames.
There is no known workaround at this time.
All Rasterbar libtorrent users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/rb_libtorrent-0.13-r1"
All Deluge users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-p2p/deluge-1.1.9"