Description
Buffer overflow in URI processing in HTTrack and WinHTTrack before 3.42-3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long URL.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | httrack | 3.42.3-1 | — |
| Debian 13 | httrack | 3.42.3-1 | — |
| Debian 12 | httrack | 3.42.3-1 | — |
| Debian 4.0 | httrack | 3.40.4-3.1+etch1 | DSA-1626-1 |
Advisories 1
- DSA-1626-1 httrack - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- httrack-urls-bo(44167) vdb-entry
- http://www.httrack.com/history.txt
- ADV-2008-2221 vdb-entry
- DSA-1626 vendor-advisory
- http://www.venustech.com.cn/NewsInfo/124/2032.Html
- 31323 third-party-advisory
- 30425 vdb-entry
- FEDORA-2008-7896 vendor-advisory
- FEDORA-2008-7862 vendor-advisory
- 31866 third-party-advisory
- 31380 third-party-advisory