CVE-2017-9031

Name	CVE-2017-9031
Description	The WebUI component in Deluge before 1.3.15 contains a directory traversal vulnerability involving a request in which the name of the render file is not associated with any template file.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
References	DLA-943-1, DSA-3856-1
NVD severity	high (attack range: remote)
Debian Bugs	862611

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
deluge (PTS)	jessie (security), jessie	1.3.10-3+deb8u1	fixed
	stretch	1.3.13+git20161130.48cedf63-3	fixed
	buster, sid	1.3.15-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
deluge	source	(unstable)	1.3.13+git20161130.48cedf63-3	high		862611
deluge	source	jessie	1.3.10-3+deb8u1	high	DSA-3856-1
deluge	source	wheezy	1.3.3-2+nmu1+deb7u2	high	DLA-943-1

Notes

http://dev.deluge-torrent.org/wiki/ReleaseNotes/1.3.15
Fixed by: http://git.deluge-torrent.org/deluge/commit/?h=1.3-stable&id=41acade01ae88f7b7bbdba308a0886771aa582fd