Synopsis: Moderate: wget security update
Advisory ID: SLSA-2014:1764-1
Issue Date: 2014-10-30
CVE Numbers: CVE-2014-4877
—
A flaw was found in the way Wget handled symbolic links. A malicious FTP
server could allow Wget running in the mirror mode (using the ‘-m’ command
line option) to write an arbitrary file to a location writable to by the
user running Wget, possibly leading to code execution. (CVE-2014-4877)
Note: This update changes the default value of the –retr-symlinks option.
The file symbolic links are now traversed by default and pointed-to files
are retrieved rather than creating a symbolic link locally.
—
SL6
x86_64
wget-1.12-5.el6_6.1.x86_64.rpm
wget-debuginfo-1.12-5.el6_6.1.x86_64.rpm
i386
wget-1.12-5.el6_6.1.i686.rpm
wget-debuginfo-1.12-5.el6_6.1.i686.rpm
SL7
x86_64
wget-1.14-10.el7_0.1.x86_64.rpm
wget-debuginfo-1.14-10.el7_0.1.x86_64.rpm
– Scientific Linux Development Team
