Mandriva Linux Security Advisory 2010-098 – The name attribute of the file element of metalink files is not properly sanitized before being used to download files. If a user is tricked into downloading from a specially crafted metalink file, this can be exploited to download files to directories outside of the intended download directory via directory traversal attacks. Packages for 2009.0 are provided due to the Extended Maintenance Program. The corrected packages solves these problems.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/89677/MDVSA-2010-098.txt
Source: https://packetstormsecurity.com/files/89677/Mandriva-Linux-Security-Advisory-2010-098.html