CVE-2019-5953

CVE-2019-5953 describes a buffer overflow in GNU Wget (affected versions 1.20.1 and earlier) that could allow a remote attacker to cause a DoS or potentially execute arbitrary code via unspecified vectors. Public sources in connected documents point to a heap-based/buffer overflow in wget’s input...

CVE-2024-38428

CVE-2024-38428 affects GNU Wget up to 1.24.5 and is caused by improper handling of semicolons in the userinfo subcomponent of a URI, which can cause data intended for userinfo to be misinterpreted as part of the host. The Connected documents confirm multiple advisories (Brocade SANnav/SANnav v2.x...

CVE-2017-13089

Summary: CVE-2017-13089 affects wget prior to 1.19.2. The issue is a stack-based buffer overflow in the HTTP protocol handling for chunked responses, caused by parsing chunk lengths with strtol() without enforcing non-negativity, leading to an attacker-controlled length passed to fd_read(). A rel...

CVE-2017-13090

The connected documents confirm CVE-2017-13090 affects wget prior to 1.19.2, due to chunked HTTP processing in retr.c:fd_read_body(). The chunk parser uses strtol() to read chunk lengths but does not validate non-negativity; then reads chunks with MIN(..) and passes a negative length to fd_read()...

CVE-2014-4877

Consolidated details for CVE-2014-4877: GNU Wget before 1.16 is vulnerable when recursion is enabled. A crafted LIST response from a remote FTP server can cause Wget to write to arbitrary files and, consequently, execute arbitrary code due to a symlink-related directory listing that references th...