SCIENTIFIC-LINUX-ERRATA Archives

November 2014

SCIENTIFIC-LINUX-ERRATA@LISTSERV.FNAL.GOV
Options: Use Monospaced Font
Show Text Part by Default
Show All Mail Headers

Message: [<< First] [< Prev] [Next >] [Last >>]
Topic: [<< First] [< Prev] [Next >] [Last >>]
Author: [<< First] [< Prev] [Next >] [Last >>]

Print Reply
Subject:
Security ERRATA Moderate: wget on SL6.x, SL7.x i386/x86_64
From:
Pat Riehecky <[log in to unmask]>
Reply To:
[log in to unmask]
Date:
Mon, 3 Nov 2014 17:52:32 +0000
Content-Type:
text/plain
Parts/Attachments:
text/plain (30 lines) 
Synopsis:          Moderate: wget security update
Advisory ID:       SLSA-2014:1764-1
Issue Date:        2014-10-30
CVE Numbers:       CVE-2014-4877
--

A flaw was found in the way Wget handled symbolic links. A malicious FTP
server could allow Wget running in the mirror mode (using the '-m' command
line option) to write an arbitrary file to a location writable to by the
user running Wget, possibly leading to code execution. (CVE-2014-4877)

Note: This update changes the default value of the --retr-symlinks option.
The file symbolic links are now traversed by default and pointed-to files
are retrieved rather than creating a symbolic link locally.
--

SL6
  x86_64
    wget-1.12-5.el6_6.1.x86_64.rpm
    wget-debuginfo-1.12-5.el6_6.1.x86_64.rpm
  i386
    wget-1.12-5.el6_6.1.i686.rpm
    wget-debuginfo-1.12-5.el6_6.1.i686.rpm
SL7
  x86_64
    wget-1.14-10.el7_0.1.x86_64.rpm
    wget-debuginfo-1.14-10.el7_0.1.x86_64.rpm

- Scientific Linux Development Team

ATOM RSS1 RSS2