SB2014102904 - Slackware Linux update for wget
Published: October 29, 2014 Updated: May 6, 2017
Security Bulletin ID
SB2014102904
Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Path traversal (CVE-ID: CVE-2014-4877)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.
Remediation
Install update from vendor's website.