ESB-2019.1168 - [Debian] wget: Multiple vulnerabilities 2019-04-08

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2019.1168
                           wget security update
                               8 April 2019

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           wget
Publisher:         Debian
Operating System:  Debian GNU/Linux 9
Impact/Access:     Execute Arbitrary Code/Commands -- Remote with User Interaction
                   Denial of Service               -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2019-5953  

Reference:         ESB-2019.1025.2

Original Bulletin: 
   http://www.debian.org/security/2019/dsa-4425

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- - -------------------------------------------------------------------------
Debian Security Advisory DSA-4425-1                   security@debian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
April 05, 2019                        https://www.debian.org/security/faq
- - -------------------------------------------------------------------------

Package        : wget
CVE ID         : CVE-2019-5953
Debian Bug     : 926389

Kusano Kazuhiko discovered a buffer overflow vulnerability in the
handling of Internationalized Resource Identifiers (IRI) in wget, a
network utility to retrieve files from the web, which could result in
the execution of arbitrary code or denial of service when recursively
downloading from an untrusted server.

For the stable distribution (stretch), this problem has been fixed in
version 1.18-5+deb9u3.

We recommend that you upgrade your wget packages.

For the detailed security status of wget please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/wget

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlynxeZfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0Qhfg/6A0X8LF3leDrRWeVdRRmpDcFTenmnzjdhnnZce4KLddMPu6L0L91Nr9gA
CVbyxqVporj4dtvEaAdZJLgpqTAGJFhwkCuFYoyI1AQINsbsOId6eEYntY/bWXyh
JBQfQq1eurhB0QZHztyeybr2aGtFY7ONZQ1BXgehnTmaGN4qXEcmU5x/hYzjVNCt
PO6fgN/ZvxSl6uPEAK2Q19+yLppT7wVv12Z4RYNUqrWwFn1snfWk/NiWXtbr5sTT
oYa6CqlGgiI+9Y9BxA5Qo0oKU2JrnWSm2nSCzpxI9dMHvgdko2To/1PiGxSbTOPQ
bit4siOk2W2hF85rv3LpDFMtqEC9VsuP1EWRIGE+7jr9fw8yJ8kS18OPF7aa1E6d
f/mPA0NH2t09mFbMEcP3rvUdRkwwgTP9zENMs4TTWfDOThAuAqqldpDhrjTtqE14
5/FxqZ96NjmmI5CoYi7dUEsZ+yU+m7BeSvUr764/7tPi7UPD3TGW0a0Rk8ryRT0l
0X5JZo+D+H1kXhMO4Wnq92qAPtQ9ZPloRaYhhuakO9dY1HguzGjgjo7FlvuN7P4P
j9F4o2dcV81vOan08zs4ZVdkNedAa05S35Uro80LUfKoQZeSfWFhTYQUrriojjKX
VEo/3MQ2GHpJW6kmd2yJUrQlEKTOSzEoP0CpaTc1rL/9rUvRm50=
=uXvM
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXKq4B2aOgq3Tt24GAQi7XA/+MYNolT/6JfEafMu2AVcPkboP7713rYY7
NRwCXq57oAGQRH/O4OKEbvK6Me+fjMNDDANLknqkqvdWWnfQx7DSnmNGhKc49ad7
PtZJPKQaK97zM0tuqros1uxZ2OwqcTpFNrnqxpSTPLh9ysWm95/0HJJPIrIsBOPZ
aWwlAckv2G4Plvmw1uW6Z+JO/hK3Y66Eh7jA59PL4ozZ3keVW6tmLLlmP+bGdaLl
RneQFTZ+vWefbSFn7vqGsoaXB4g5jZ5UyEshmAxx2owsQJvoiIvwQ+xJBLTgFP/7
nTpT5dErFYGeQttNc0/1z4TOEIKIIPDJvTHjyFWVjyIcH7zEv8CiG6n9Vfxj/v8C
sEWlG0xxx2DGZh2AkgWo4EQtPo4MX92XX1KbExJnPXFuvDMrSUHx1VoZDjI+Z9kh
4DHJ/W8yvcgmECEYYCOjES8lA/jDCQ9+IclamHhEkwnLJVLGPoU5YyBEqgnmzlYc
gI5R96Nw6bL9y8F0ZQVsVFEwWtmecJEecvzGXmlbQH7EcyE60rtixVZc8tXlHtk5
Hnxx320n8p5+o+B56vhgIOjR5P7m9ki1bGMqNOvhsOzu/XgTxrGYV/0+4JIaKBmN
rT8A7iUDn020sdHKQbObZ6DXp8Ues/3MXSxwhvCzcJ4QkCJGqla3CoczS1iugH71
g1N3WL2Xb+o=
=uCud
-----END PGP SIGNATURE-----

« Back to bulletins