A vulnerability has been discovered in aria2, which can be exploited by malicious people to compromise a user's system.

A format string error exists within the "AbstractCommand::onAbort()" function in src/AbstractCommand.cc when printing the URL of an aborted download, which can be exploited by e.g. tricking a user into downloading from a specially crafted metalink file.

Successful exploitation requires that logging is enabled.

The vulnerability is confirmed in version 1.6.1. Prior versions may also be affected.

Solution
Update to version 1.6.2.

Provided and/or discovered by
Reported by the vendor.

Original Advisory
http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NEWS?revision=1586

Deep Links
Links available in Customer Area