CVE-2004-1487
Fixed in a distro release EPSS 2%
wget 1.8.x and 1.9.x allows a remote malicious web server to overwrite certain files via a redirection URL containing a ".." that resolves to the IP address of the malicious server, which bypasses wget's filtering for ".." sequences.
Products: gnu wget
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | wget | 1.9.1-11 |
| Debian 13 | wget | 1.9.1-11 |
| Debian 14 | wget | 1.9.1-11 |
| Red Hat Enterprise Linux 3 | wget | 0:1.10.1-1.30E.1 |
| Red Hat Enterprise Linux 3 | wget-debuginfo | 0:1.10.1-1.30E.1 |
| Red Hat Enterprise Linux 4 | wget | 0:1.10.1-2.4E.1 |
| Red Hat Enterprise Linux 4 | wget-debuginfo | 0:1.10.1-2.4E.1 |