wget-1.21.1-2.2 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:11510 Final 1 1 2024-06-17T21:45:33Z current 2024-06-17T21:45:33Z 2024-06-17T21:45:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z wget-1.21.1-2.2 on GA media These are all security issues fixed in the wget-1.21.1-2.2 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-11510 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) E-Mail link for openSUSE-SU-2024:11510 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2006-6719/ SUSE CVE CVE-2006-6719 page https://www.suse.com/security/cve/CVE-2017-13089/ SUSE CVE CVE-2017-13089 page https://www.suse.com/security/cve/CVE-2017-13090/ SUSE CVE CVE-2017-13090 page https://www.suse.com/security/cve/CVE-2017-6508/ SUSE CVE CVE-2017-6508 page https://www.suse.com/security/cve/CVE-2018-0494/ SUSE CVE CVE-2018-0494 page https://www.suse.com/security/cve/CVE-2018-20483/ SUSE CVE CVE-2018-20483 page https://www.suse.com/security/cve/CVE-2019-5953/ SUSE CVE CVE-2019-5953 page openSUSE Tumbleweed wget-1.21.1-2.2 wget-lang-1.21.1-2.2 wget-1.21.1-2.2 as a component of openSUSE Tumbleweed wget-lang-1.21.1-2.2 as a component of openSUSE Tumbleweed The ftp_syst function in ftp-basic.c in Free Software Foundation (FSF) GNU wget 1.10.2 allows remote attackers to cause a denial of service (application crash) via a malicious FTP server with a large number of blank 220 responses to the SYST command. CVE-2006-6719 openSUSE Tumbleweed:wget-1.21.1-2.2 openSUSE Tumbleweed:wget-lang-1.21.1-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2006-6719.html CVE-2006-6719 https://bugzilla.suse.com/231063 SUSE Bug 231063 The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument. CVE-2017-13089 openSUSE Tumbleweed:wget-1.21.1-2.2 openSUSE Tumbleweed:wget-lang-1.21.1-2.2 moderate 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-13089.html CVE-2017-13089 https://bugzilla.suse.com/1064715 SUSE Bug 1064715 The retr.c:fd_read_body() function is called when processing OK responses. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to read the chunk in pieces of 8192 bytes by using the MIN() macro, but ends up passing the negative chunk length to retr.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument. The attacker can corrupt malloc metadata after the allocated buffer. CVE-2017-13090 openSUSE Tumbleweed:wget-1.21.1-2.2 openSUSE Tumbleweed:wget-lang-1.21.1-2.2 moderate 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-13090.html CVE-2017-13090 https://bugzilla.suse.com/1064716 SUSE Bug 1064716 CRLF injection vulnerability in the url_parse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in the host subcomponent of a URL. CVE-2017-6508 openSUSE Tumbleweed:wget-1.21.1-2.2 openSUSE Tumbleweed:wget-lang-1.21.1-2.2 moderate 5.8 AV:N/AC:M/Au:N/C:N/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-6508.html CVE-2017-6508 https://bugzilla.suse.com/1028301 SUSE Bug 1028301 https://bugzilla.suse.com/1159418 SUSE Bug 1159418 GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line. CVE-2018-0494 openSUSE Tumbleweed:wget-1.21.1-2.2 openSUSE Tumbleweed:wget-lang-1.21.1-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-0494.html CVE-2018-0494 https://bugzilla.suse.com/1092061 SUSE Bug 1092061 https://bugzilla.suse.com/1123797 SUSE Bug 1123797 https://bugzilla.suse.com/1159418 SUSE Bug 1159418 set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl. CVE-2018-20483 openSUSE Tumbleweed:wget-1.21.1-2.2 openSUSE Tumbleweed:wget-lang-1.21.1-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-20483.html CVE-2018-20483 https://bugzilla.suse.com/1120382 SUSE Bug 1120382 Buffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of-service (DoS) or may execute an arbitrary code via unspecified vectors. CVE-2019-5953 openSUSE Tumbleweed:wget-1.21.1-2.2 openSUSE Tumbleweed:wget-lang-1.21.1-2.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-5953.html CVE-2019-5953 https://bugzilla.suse.com/1131493 SUSE Bug 1131493