CVE-2014-4877

NameCVE-2014-4877
DescriptionAbsolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-82-1, DSA-3062-1
Debian Bugs766981

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
wget (PTS)buster1.20.1-1.1fixed
bullseye1.21-1+deb11u1fixed
bookworm1.21.3-1fixed
trixie1.21.4-1fixed
sid1.24.5-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
wgetsourcesqueeze1.12-2.1+deb6u1DLA-82-1
wgetsourcewheezy1.13.4-3+deb7u2DSA-3062-1
wgetsource(unstable)1.16-1766981

Notes

http://git.savannah.gnu.org/cgit/wget.git/commit/?id=18b0979357ed7dc4e11d4f2b1d7e0f5932d82aa7

Search for package or bug name: Reporting problems