CVE-2007-0159

no score yetEPSS 2.1%

Directory traversal vulnerability in the GeoIP_update_database_general function in libGeoIP/GeoIPUpdate.c in GeoIP 1.4.0 allows remote malicious update servers (possibly only update.maxmind.com) to overwrite arbitrary files via a .. (dot dot) in the database filename, which is returned by a request to app/update_getfilename.

EPSS: 2.1% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
Published: 2007-01-10
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

geoip:geoip

References

http://arctic.org/~dean/patches/GeoIP-1.4.0-update-vulnerability.patch
http://osvdb.org/31618
http://secunia.com/advisories/23880
http://secunia.com/advisories/23906
http://www.mandriva.com/security/advisories?name=MDKSA-2007:004

Check your stack JSON