A vulnerability in GNU Wget might allow an attacker to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/wget | * | < 1.20.3 | >= 1.20.3 |
GNU Wget is a free software package for retrieving files using HTTP, HTTPS and FTP, the most widely-used Internet protocols.
A buffer overflow was discovered in GNU’s Wget.
An attacker could possibly execute arbitrary code with the privileges of the process or cause a Denial of Service condition.
There is no known workaround at this time.
All GNU Wget users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/wget-1.20.3"
A vulnerability in GNU Wget which could allow an attacker to obtain sensitive information.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/wget | * | < 1.20.1 | >= 1.20.1 |
GNU Wget is a free software package for retrieving files using HTTP, HTTPS and FTP, the most widely-used Internet protocols.
A vulnerability was discovered in GNU Wget’s file_metadata in xattr.c.
A local attacker could obtain sensitive information to include credentials.
There is no known workaround at this time.
All GNU Wget users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/wget-1.20.1"
A vulnerablity in GNU Wget could allow arbitrary cookies to be injected.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/wget | * | < 1.19.5 | >= 1.19.5 |
GNU Wget is a free software package for retrieving files using HTTP, HTTPS and FTP, the most widely-used Internet protocols.
A vulnerability was discovered in GNU Wget’s resp_new function which does not validate \r\n sequences in continuation lines.
A remote attacker could inject arbitrary cookie entry requests.
There is no known workaround at this time.
All GNU Wget users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/wget-1.19.5"
Multiple vulnerabilities have been found in Wget, the worst of which could allow remote attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/wget | * | < 1.19.1-r2 | >= 1.19.1-r2 |
GNU Wget is a free software package for retrieving files using HTTP, HTTPS and FTP, the most widely-used Internet protocols.
Multiple vulnerabilities have been discovered in Wget. Please review the referenced CVE identifiers for details.
A remote attacker, by enticing a user to connect to a malicious server, could remotely execute arbitrary code or cause a Denial of Service condition.
There is no known workaround at this time.
All Wget users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/wget-1.19.1-r2"
A header injection vulnerability in GNU Wget might allow remote attackers to inject arbitrary HTTP headers.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/wget | * | < 1.19.1-r1 | >= 1.19.1-r1 |
GNU Wget is a free software package for retrieving files using HTTP, HTTPS and FTP, the most widely-used Internet protocols.
It was discovered that there was a header injection vulnerability in GNU Wget which allowed remote attackers to inject arbitrary HTTP headers via CRLF sequences in the host subcomponent of a URL.
A remote attacker could inject arbitrary HTTP headers in requests by tricking a user running GNU Wget into processing crafted URLs.
There is no known workaround at this time.
All GNU Wget users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/wget-1.19.1-r1"
Multiple vulnerabilities have been found in Wget, the worst of which could lead to the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/wget | * | < 1.18 | >= 1.18 |
GNU Wget is a free software package for retrieving files using HTTP, HTTPS and FTP, the most widely-used Internet protocols.
Multiple vulnerabilities have been discovered in Wget. Please review the CVE identifier and bug reports referenced for details.
A remote attacker could possibly execute arbitrary code with the privileges of the process or obtain sensitive information.
There is no known workaround at this time.
All GNU Wget users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/wget-1.18"
An absolute path traversal vulnerability could lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/wget | * | < 1.16 | >= 1.16 |
GNU Wget is a free software package for retrieving files using HTTP, HTTPS and FTP, the most widely-used Internet protocols.
An absolute path traversal vulnerability has been found in GNU Wget.
A remote FTP server is able to write to arbitrary files, and consequently execute arbitrary code.
There is no known workaround at this time.
All GNU Wget users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/wget-1.16"
Insecure usage of server provided filenames may allow the creation or overwriting of local files.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/wget | * | < 1.12-r2 | >= 1.12-r2 |
GNU Wget is a free software package for retrieving files using HTTP, HTTPS and FTP, the most widely-used Internet protocols.
It was discovered that Wget was unsafely trusting server-provided filenames. This allowed attackers to overwrite or create files on the user's system by sending a redirect from the expected URL to another URL specifying the targeted file.
An unauthenticated remote attacker may be able to create or overwrite local files by enticing the user to open an attacker controlled URL, possibly leading to execution of arbitrary code.
There is no known workaround at this time.
All Wget users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/wget-1.12-r2"
NOTE: This is a legacy GLSA. Updates for all affected architectures are available since September 19, 2010. It is likely that your system is already no longer affected by this issue.
An error in the X.509 certificate handling of Wget might enable remote attackers to conduct man-in-the-middle attacks.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/wget | * | < 1.12 | >= 1.12 |
GNU Wget is a free software package for retrieving files using HTTP, HTTPS and FTP, the most widely-used Internet protocols.
The vendor reported that Wget does not properly handle Common Name (CN) fields in X.509 certificates that contain an ASCII NUL (\0) character. Specifically, the processing of such fields is stopped at the first occurrence of a NUL character. This type of vulnerability was recently discovered by Dan Kaminsky and Moxie Marlinspike.
A remote attacker might employ a specially crafted X.509 certificate, containing a NUL character in the Common Name field to conduct man-in-the-middle attacks on SSL connections made using Wget.
There is no known workaround at this time.
All Wget users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/wget-1.12"