GNU wget HTTP Redirect Arbitrary File Overwrite (CVE-2016-4971)

An arbitrary file overwrite vulnerability has been reported in the GNU wget. The vulnerability is due to wget trusting the filename provided by an FTP server when the original request is redirected from an HTTP server. A remote attacker can exploit this vulnerability by enticing a user to request...

GNU Wget Arbitrary File Upload / Potential Remote Code Execution

============================================= - Release date: 06.07.2016 - Discovered by: Dawid Golunski - Severity: High - CVE-2016-4971 ============================================= I. VULNERABILITY ------------------------- GNU Wget 1.18 Arbitrary File Upload / Potential RCE II. BACKGROUND...

GNU Wget < 1.18 - Arbitrary File Upload / Remote Code Execution

Exploit for linux platform in category remote exploits ============================================= - Release date: 06.07.2016 - Discovered by: Dawid Golunski - Severity: High - CVE-2016-4971 ============================================= I. VULNERABILITY ------------------------- GNU Wget 1.18...

Vulnerabilities of the Debian GNU/Linux operating system that allow a remote attacker to compromise the accessibility of protected information

The multiple vulnerabilities in the krb5-ftpd package of the Debian GNU/Linux operating system may lead to a violation of the accessibility of protected information. These vulnerabilities can be exploited remotely...

GNU Wget < 1.18 - Arbitrary File Upload / Remote Code Execution

============================================= - Release date: 06.07.2016 - Discovered by: Dawid Golunski - Severity: High - CVE-2016-4971 ============================================= I. VULNERABILITY ------------------------- GNU Wget 1.18 Arbitrary File Upload / Potential Remote Code Execution...

GNU Wget 1.18 - Arbitrary File Upload Remote Code Execution

GNU Wget 1.18 - Arbitrary File Upload Remote Code Execution ============================================= - Release date: 06.07.2016 - Discovered by: Dawid Golunski - Severity: High - CVE-2016-4971 ============================================= I. VULNERABILITY ------------------------- GNU Wget...

[slackware-security] mozilla-thunderbird

New mozilla-thunderbird packages are available for Slackware 14.1, 14.2, and - -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mozilla-thunderbird-45.2.0-i586-1slack14.2.txz: Upgraded. This release contains security fixes and improvements...

CVE-2016-1440

The proxy process on Cisco Web Security Appliance WSA devices through 9.1.0-070 allows remote attackers to cause a denial of service CPU consumption by establishing an FTP session and then improperly terminating the control connection after a file transfer, aka Bug ID CSCuy43468...

Design/Logic Flaw

The proxy process on Cisco Web Security Appliance WSA devices through 9.1.0-070 allows remote attackers to cause a denial of service CPU consumption by establishing an FTP session and then improperly terminating the control connection after a file transfer, aka Bug ID CSCuy43468...

CVE-2016-1440

The proxy process on Cisco Web Security Appliance WSA devices through 9.1.0-070 allows remote attackers to cause a denial of service CPU consumption by establishing an FTP session and then improperly terminating the control connection after a file transfer, aka Bug ID CSCuy43468...

Debian DLA-536-1 : wget security update

On a server redirect from HTTP to a FTP resource, wget would trust the HTTP server and uses the name in the redirected URL as the destination filename. This behaviour was changed and now it works similarly as a redirect from HTTP to another HTTP resource so the original name is used as the...

[SECURITY] [DLA 536-1] wget security update

Package : wget Version : 1.13.4-3+deb7u3 CVE ID : CVE-2016-4971 Debian Bug : 827003 On a server redirect from HTTP to a FTP resource, wget would trust the HTTP server and uses the name in the redirected URL as the destination filename. This behaviour was changed and now it works similarly as a...

CVE-2016-4971

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource...

CVE-2016-4971

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource...

ALPINE-CVE-2016-4971

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource...

Cross site request forgery (csrf)

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource...

CVE-2016-4971

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource...

CVE-2016-4971

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource...

CVE-2016-4971

CVE-2016-4971 affects GNU Wget prior to 1.18. The issue occurs when following an HTTP redirect to an FTP resource: the filename provided by the server is trusted, which can cause wget to overwrite a local file with a name from the redirected resource. This could potentially allow arbitrary file o...

CVE-2016-4971

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource...