Skip to content
OpenAdvisories
High RHSA-2017:3075 2 CVEs

Red Hat Security Advisory: wget security update

Published Sep 16, 2024 · Updated Jul 1, 2026

Ecosystem: Red Hat

Fixed packages 8

ReleasePackageFixed in
Red Hat · RHEL 7 enterprise_linux:7::client wget 0:1.14-15.el7_4.1
Red Hat · RHEL 7 enterprise_linux:7::client wget-debuginfo 0:1.14-15.el7_4.1
Red Hat · RHEL 7 enterprise_linux:7::computenode wget 0:1.14-15.el7_4.1
Red Hat · RHEL 7 enterprise_linux:7::computenode wget-debuginfo 0:1.14-15.el7_4.1
Red Hat · RHEL 7 enterprise_linux:7::server wget 0:1.14-15.el7_4.1
Red Hat · RHEL 7 enterprise_linux:7::server wget-debuginfo 0:1.14-15.el7_4.1
Red Hat · RHEL 7 enterprise_linux:7::workstation wget 0:1.14-15.el7_4.1
Red Hat · RHEL 7 enterprise_linux:7::workstation wget-debuginfo 0:1.14-15.el7_4.1

Vulnerabilities 2

  • High 8.8
    CVE-2017-13089 Public exploit EPSS 80%

    GNU Wget: stack overflow in HTTP protocol handling

    The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk len…

    GNU wget wget wget Debian Ubuntu Alpine
  • High 8.8
    CVE-2017-13090 EPSS 37%

    GNU Wget: heap overflow in HTTP protocol handling

    The retr.c:fd_read_body() function is called when processing OK responses. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. T…

    GNU wget wget wget Debian Ubuntu Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1505444
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1505445
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_3075.json
  • report
    https://access.redhat.com/security/cve/CVE-2017-13089
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-13089
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-13089
  • article
    https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2017/haavoittuvuus-2017-037.html
  • report
    https://access.redhat.com/security/cve/CVE-2017-13090
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-13090
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-13090