wget - directory traversal

Two problems have been found in the wget package as distributed in
Debian GNU/Linux:

• Stefano Zacchiroli found a buffer overrun in the url_filename function,
  which would make wget segfault on very long URLs
• Steven M. Christey discovered that wget did not verify the FTP server
  response to a NLST command: it must not contain any directory information,
  since that can be used to make an FTP client overwrite arbitrary files.

Both problems have been fixed in version 1.5.3-3.1 for Debian GNU/Linux
2.2/potato and version 1.8.1-6.1 for Debian GNU/Linux 3.0/woody.