Lucene search

K
slackwareSlackware Linux ProjectSSA-2017-300-02
HistoryOct 27, 2017 - 8:55 p.m.

[slackware-security] wget

2017-10-2720:55:58
Slackware Linux Project
www.slackware.com
12

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.645 Medium

EPSS

Percentile

97.8%

New wget packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1,
14.2, and -current to fix security issues.

Here are the details from the Slackware 14.2 ChangeLog:

patches/packages/wget-1.19.2-i586-1_slack14.2.txz: Upgraded.
This update fixes stack and heap overflows in in HTTP protocol handling.
For more information, see:
https://vulners.com/cve/CVE-2017-13089
https://vulners.com/cve/CVE-2017-13090
(* Security fix *)

Where to find the new packages:

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)

Also see the “Get Slack” section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/wget-1.19.2-i486-1_slack13.0.txz

Updated package for Slackware x86_64 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/wget-1.19.2-x86_64-1_slack13.0.txz

Updated package for Slackware 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/wget-1.19.2-i486-1_slack13.1.txz

Updated package for Slackware x86_64 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/wget-1.19.2-x86_64-1_slack13.1.txz

Updated package for Slackware 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/wget-1.19.2-i486-1_slack13.37.txz

Updated package for Slackware x86_64 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/wget-1.19.2-x86_64-1_slack13.37.txz

Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/wget-1.19.2-i486-1_slack14.0.txz

Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/wget-1.19.2-x86_64-1_slack14.0.txz

Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/wget-1.19.2-i486-1_slack14.1.txz

Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/wget-1.19.2-x86_64-1_slack14.1.txz

Updated package for Slackware 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/wget-1.19.2-i586-1_slack14.2.txz

Updated package for Slackware x86_64 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/wget-1.19.2-x86_64-1_slack14.2.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/wget-1.19.2-i586-1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/wget-1.19.2-x86_64-1.txz

MD5 signatures:

Slackware 13.0 package:
6a2fdea44aeb773a883b8179fa05f8dd wget-1.19.2-i486-1_slack13.0.txz

Slackware x86_64 13.0 package:
1cbdea2a72f55841ec7497a33a4050d2 wget-1.19.2-x86_64-1_slack13.0.txz

Slackware 13.1 package:
2b931c21e366f28c3ec3d566895808e1 wget-1.19.2-i486-1_slack13.1.txz

Slackware x86_64 13.1 package:
3a0040373718b879ff81a590821cc957 wget-1.19.2-x86_64-1_slack13.1.txz

Slackware 13.37 package:
63e6d6396de6264109fc5db75a89a1fa wget-1.19.2-i486-1_slack13.37.txz

Slackware x86_64 13.37 package:
19a525ee83e14446902d4bb4fe0850c8 wget-1.19.2-x86_64-1_slack13.37.txz

Slackware 14.0 package:
c57618f9fa8a13d00989ebf03622803b wget-1.19.2-i486-1_slack14.0.txz

Slackware x86_64 14.0 package:
4d0fecab36336e9b00f841881852a619 wget-1.19.2-x86_64-1_slack14.0.txz

Slackware 14.1 package:
b32791160dcf03d91721644a2d997c03 wget-1.19.2-i486-1_slack14.1.txz

Slackware x86_64 14.1 package:
c534b54abed76e5bb452f06cb3fd0f7e wget-1.19.2-x86_64-1_slack14.1.txz

Slackware 14.2 package:
1d20fe71cba764a5fd516329b3c84043 wget-1.19.2-i586-1_slack14.2.txz

Slackware x86_64 14.2 package:
52f27f37dc54642f430790ba1f7ba5db wget-1.19.2-x86_64-1_slack14.2.txz

Slackware -current package:
c528ea9f78c9658d620951fe575e2757 n/wget-1.19.2-i586-1.txz

Slackware x86_64 -current package:
d3bdaa039410b993ac729bf88c80905f n/wget-1.19.2-x86_64-1.txz

Installation instructions:

Upgrade the package as root:
> upgradepkg wget-1.19.2-i586-1_slack14.2.txz

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.645 Medium

EPSS

Percentile

97.8%