CVE-2014-4877
Fixed in a distro release EPSS 40%
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.
Products: gnu wget
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | wget | 1.16-1 |
| Debian 13 | wget | 1.16-1 |
| Debian 14 | wget | 1.16-1 |
| Debian 6.0 | wget | 1.12-2.1+deb6u1 |
| Debian 7 | wget | 1.13.4-3+deb7u2 |
| Red Hat Enterprise Linux 6 | wget | 0:1.12-5.el6_6.1 |
| Red Hat Enterprise Linux 6 | wget-debuginfo | 0:1.12-5.el6_6.1 |
| Red Hat Enterprise Linux 7 | wget | 0:1.14-10.el7_0.1 |
| Red Hat Enterprise Linux 7 | wget-debuginfo | 0:1.14-10.el7_0.1 |
| Red Hat rhel eus 6.5 | wget | 0:1.12-1.12.el6_5 |
| Red Hat rhel eus 6.5 | wget-debuginfo | 0:1.12-1.12.el6_5 |
| Ubuntu 14.04 LTS | wget | 1.15-1ubuntu1.14.04.1 |
| openSUSE Tumbleweed | wget | 1.18-2.3 |