Synopsis: Moderate: wget security update
Advisory ID: SLSA-2014:1764-1
Issue Date: 2014-10-30
CVE Numbers: CVE-2014-4877
A flaw was found in the way Wget handled symbolic links. A malicious FTP
server could allow Wget running in the mirror mode (using the ‘-m’ command
line option) to write an arbitrary file to a location writable to by the
user running Wget, possibly leading to code execution. (CVE-2014-4877)
Note: This update changes the default value of the –retr-symlinks option.
The file symbolic links are now traversed by default and pointed-to files
are retrieved rather than creating a symbolic link locally.
– Scientific Linux Development Team