An update of the wget package has been released.

An update for wget is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols.

Security Fix(es) :

* A stack-based and a heap-based buffer overflow flaws were found in wget when processing chunked encoded HTTP responses. By tricking an unsuspecting user into connecting to a malicious HTTP server, an attacker could exploit these flaws to potentially execute arbitrary code. (CVE-2017-13089, CVE-2017-13090)

Red Hat would like to thank the GNU Wget project for reporting these issues.

CVE-2017-13089 Fix stack overflow in HTTP protocol handling.

CVE-2017-13090 Fix heap overflow in HTTP protocol handling.

For Debian 7 'Wheezy', these problems have been fixed in version 1.13.4-3+deb7u5.

We recommend that you upgrade your wget packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the wget package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A stack-based and a heap-based buffer overflow flaws     were found in wget when processing chunked encoded HTTP     responses. By tricking an unsuspecting user into     connecting to a malicious HTTP server, an attacker     could exploit these flaws to potentially execute     arbitrary code. (CVE-2017-13089, CVE-2017-13090)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201711-06 (GNU Wget: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wget. Please review the       referenced CVE identifiers for details.
  Impact :

    A remote attacker, by enticing a user to connect to a malicious server,       could remotely execute arbitrary code or cause a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

new upstream release with CVE fixes

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of [wget] packages for PhotonOS has been released.

Security Fix(es) :

  - A stack-based and a heap-based buffer overflow flaws     were found in wget when processing chunked encoded HTTP     responses. By tricking an unsuspecting user into     connecting to a malicious HTTP server, an attacker could     exploit these flaws to potentially execute arbitrary     code. (CVE-2017-13089, CVE-2017-13090)

According to the versions of the wget package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A cookie injection flaw was found in wget. An attacker     can create a malicious website which, when accessed,     overrides cookies belonging to arbitrary     domains.(CVE-2018-0494)

  - A stack-based buffer overflow when processing chunked,     encoded HTTP responses was found in wget. By tricking     an unsuspecting user into connecting to a malicious     HTTP server, an attacker could exploit this flaw to     potentially execute arbitrary code.(CVE-2017-13089)

  - A heap-based buffer overflow, when processing chunked     encoded HTTP responses, was found in wget. By tricking     an unsuspecting user into connecting to a malicious     HTTP server, an attacker could exploit this flaw to     potentially execute arbitrary code.(CVE-2017-13090)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
121765	Photon OS 2.0: Wget PHSA-2017-0046	Nessus	PhotonOS Local Security Checks	2019/2/7	2024/7/22	high
121766	Photon OS 1.0: Wget PHSA-2017-0047	Nessus	PhotonOS Local Security Checks	2019/2/7	2024/7/22	high
104205	RHEL 7 : wget (RHSA-2017:3075)	Nessus	Red Hat Local Security Checks	2017/10/27	2019/10/24	high
104221	Debian DLA-1149-1 : wget security update	Nessus	Debian Local Security Checks	2017/10/30	2021/1/11	high
104295	EulerOS 2.0 SP2 : wget (EulerOS-SA-2017-1270)	Nessus	Huawei Local Security Checks	2017/11/1	2021/1/6	high
104514	GLSA-201711-06 : GNU Wget: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2017/11/13	2021/1/11	high
104609	Fedora 25 : wget (2017-de8a421dcd)	Nessus	Fedora Local Security Checks	2017/11/16	2021/1/6	high
105816	Fedora 27 : wget (2017-10fbce01ec)	Nessus	Fedora Local Security Checks	2018/1/15	2021/1/11	high
111896	Photon OS 1.0: Wget PHSA-2017-0047 (deprecated)	Nessus	PhotonOS Local Security Checks	2018/8/17	2019/2/7	high
104207	Scientific Linux Security Update : wget on SL7.x x86_64 (20171026)	Nessus	Scientific Linux Local Security Checks	2017/10/27	2021/1/14	high
124916	EulerOS Virtualization for ARM 64 3.0.1.0 : wget (EulerOS-SA-2019-1413)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/23	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high