{"id":"CVE-2016-4971","aliases":["ALPINE-CVE-2016-4971","DEBIAN-CVE-2016-4971","DLA-536-1","EUVD-2016-5944","GHSA-5w8p-rj9f-xvj7","MGASA-2016-0323","RHSA-2016:2587","SUSE-SU-2016:2226-1","SUSE-SU-2016:2358-1","UBUNTU-CVE-2016-4971","USN-3012-1","openSUSE-SU-2024:10263-1"],"status":"published","title":"GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request...","description":"GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.4606,"percentile":0.98817,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"published":"2016-06-10T00:00:00Z","modified":"2026-11-01T02:45:06Z","exploits":[{"source":"pocgithub","id":"gitcollect/CVE-2016-4971","title":"gitcollect/CVE-2016-4971","date":"2016-07-02","url":"https://github.com/gitcollect/CVE-2016-4971"},{"source":"exploitdb","id":"EDB-40064","title":"GNU Wget \u003c 1.18 - Arbitrary File Upload / Remote Code Execution","type":"remote","platform":"linux","date":"2016-07-06","verified":true,"url":"https://www.exploit-db.com/exploits/40064"},{"source":"pocgithub","id":"mbadanoiu/CVE-2016-4971","title":"mbadanoiu/CVE-2016-4971","date":"2019-01-05","url":"https://github.com/mbadanoiu/CVE-2016-4971"},{"source":"pocgithub","id":"dinidhu96/IT19013756_-CVE-2016-4971-","title":"dinidhu96/IT19013756_-CVE-2016-4971-","date":"2020-05-12","url":"https://github.com/dinidhu96/IT19013756_-CVE-2016-4971-"},{"source":"exploitdb","id":"EDB-49815","title":"GNU Wget \u003c 1.18 - Arbitrary File Upload (2)","type":"remote","platform":"linux","date":"2021-04-30","url":"https://www.exploit-db.com/exploits/49815"}],"fixes":[{"ecosystem":"Alpine:v3.4","package":"wget","fixed_in":["1.17.1-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"wget","fixed_in":["1.18-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wget","fixed_in":["1.18-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wget","fixed_in":["1.18-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"wget","fixed_in":["1.13.4-3+deb7u3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"wget","fixed_in":["0:1.14-13.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"wget-debuginfo","fixed_in":["0:1.14-13.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"wget","fixed_in":["0:1.14-13.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"wget-debuginfo","fixed_in":["0:1.14-13.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"wget","fixed_in":["0:1.14-13.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"wget-debuginfo","fixed_in":["0:1.14-13.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"wget","fixed_in":["0:1.14-13.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"wget-debuginfo","fixed_in":["0:1.14-13.el7"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"wget","fixed_in":["1.15-1ubuntu1.14.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"wget","fixed_in":["1.17.1-1ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.4","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.4-3+deb7u3"}]}],"versions":["1.13.4-3","1.13.4-3+deb7u1","1.13.4-3+deb7u2"]},{"source":"osv","ecosystem":"Mageia:5","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-5.1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14-13.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"wget-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14-13.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14-13.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"wget-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14-13.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14-13.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"wget-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14-13.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14-13.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"wget-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14-13.el7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11-SECURITY","package":"wget-openssl1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"wget-openssl1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"wget-openssl1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-1ubuntu1.14.04.2"}]}],"versions":["1.14-2ubuntu1","1.14-5ubuntu1","1.15-1ubuntu1","1.15-1ubuntu1.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-1ubuntu1.1"}]}],"versions":["1.16.1-1ubuntu1","1.17.1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-1ubuntu1.14.04.2"}]}],"versions":["1.14-2ubuntu1","1.14-5ubuntu1","1.15-1ubuntu1","1.15-1ubuntu1.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-1ubuntu1.1"}]}],"versions":["1.16.1-1ubuntu1","1.17.1-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-2.3"}]}],"bundled":5}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"gnu","product":"wget"},{"vendor":"oracle","product":"solaris"},{"vendor":"paloaltonetworks","product":"pan-os"}],"references":[{"url":"http://lists.gnu.org/archive/html/info-gnu/2016-06/msg00004.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Vendor Advisory","fix","report"]},{"url":"https://security.gentoo.org/glsa/201610-11","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-08/msg00043.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","web"]},{"url":"https://www.exploit-db.com/exploits/40064/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1343666","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://git.savannah.gnu.org/cgit/wget.git/commit/?id=e996e322ffd42aaa051602da182d03178d0f13e1","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2587.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Broken Link","advisory"]},{"url":"http://www.securitytracker.com/id/1036133","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-3012-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/91530","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://security.paloaltonetworks.com/CVE-2016-4971","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://packetstormsecurity.com/files/162395/GNU-wget-Arbitrary-File-Upload-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4971","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2587","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4971","tags":["report"]},{"url":"https://www.exploit-db.com/exploits/40064"},{"url":"https://github.com/advisories/GHSA-5w8p-rj9f-xvj7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-4971","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-4971","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0323.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18671","tags":["report"]},{"url":"http://www.ubuntu.com/usn/usn-3012-1","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2016-09/msg00044.html","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.3_Release_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1147572","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2587.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4971","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162226-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/937096","tags":["report"]},{"url":"https://bugzilla.suse.com/958342","tags":["report"]},{"url":"https://bugzilla.suse.com/984060","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4971","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162358-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/995964","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7098","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-4971","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3012-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7665","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-4971","description":"GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.","status":"published","published":"2016-06-30T17:00:00Z","modified":"2024-08-06T00:46:40.047Z","updated_at":"2026-11-02T14:33:35.149563Z"}],"euvd":[{"id":"EUVD-2016-5944","description":"GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.","status":"published","published":"2016-06-30T17:00:00Z","modified":"2024-08-06T00:46:40Z","updated_at":"2026-11-03T02:22:44.489595Z"}],"ghsa":[{"id":"GHSA-5w8p-rj9f-xvj7","title":"GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request...","description":"GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.","status":"published","published":"2022-05-13T01:10:22Z","modified":"2025-04-12T13:02:36Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:01:28.663035Z"}],"nvd":[{"id":"CVE-2016-4971","description":"GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.","status":"published","published":"2016-06-30T17:59:07.893Z","modified":"2026-06-17T00:48:31.787Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:03:26.642445Z"}],"osv":[{"id":"ALPINE-CVE-2016-4971","description":"GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.","status":"published","published":"2016-06-30T17:59:07.893Z","modified":"2026-09-22T06:30:28.890873507Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:46.318571Z"},{"id":"CVE-2016-4971","description":"GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.","status":"published","published":"2016-06-30T17:59:07.893Z","modified":"2026-11-09T02:47:06.669426749Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-08T02:57:44.685242Z"},{"id":"DEBIAN-CVE-2016-4971","description":"GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.","status":"published","published":"2016-06-30T17:59:07.893Z","modified":"2026-09-22T07:01:54.730309188Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"RHSA-2016:2587","title":"Red Hat Security Advisory: wget security and bug fix update","status":"published","published":"2024-09-15T23:19:34Z","modified":"2026-06-26T10:32:02Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"UBUNTU-CVE-2016-4971","description":"GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.","status":"published","published":"2016-06-10T00:00:00Z","modified":"2026-02-04T02:30:32.422522Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:12.261906Z"},{"id":"DLA-536-1","title":"wget - security update","status":"published","published":"2016-06-30T00:00:00Z","modified":"2026-03-09T02:09:45.405621Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"MGASA-2016-0323","title":"Updated wget packages fix security vulnerability","description":"GNU wget before 1.18 allows remote servers to write to arbitrary files by\nredirecting a request from HTTP to a crafted FTP resource (CVE-2016-4971).\n\nFixed a potential race condition by creating files with .tmp ext and\nmaking them accessible to the current user only (CVE-2016-7098).\n","status":"published","published":"2016-09-28T05:59:24Z","modified":"2026-04-16T06:24:46.202021364Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:10263-1","title":"wget-1.18-2.3 on GA media","description":"These are all security issues fixed in the wget-1.18-2.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:32:36.732905Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2016:2226-1","title":"Security update for wget","description":"\nThis update for wget fixes the following issues:\n\n - Fix for HTTP to a FTP redirection file name confusion vulnerability\n   (bsc#984060, CVE-2016-4971).\n - Work around a libidn  vulnerability\n   (bsc#937096, CVE-2015-2059).\n - Fix for wget fails with basicauth: Failed writing HTTP request:\n   Bad file descriptor\n   (bsc#958342)\n","status":"published","published":"2016-09-02T11:37:48Z","modified":"2026-02-04T04:00:55.795987Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:2358-1","title":"Security update for wget","description":"\nThis update for wget fixes the following issues:\n\n- CVE-2016-4971: A HTTP to FTP redirection file name confusion vulnerability was fixed.\n  (bsc#984060).\n\n- CVE-2016-7098: A potential race condition was fixed by creating files with .tmp ext\n  and making them accessible to the current user only. (bsc#995964)\n\nBug fixed:\n- Wget failed with basicauth: Failed writing HTTP request: Bad file descriptor\n  (bsc#958342)\n","status":"published","published":"2016-09-23T12:56:12Z","modified":"2026-02-04T03:43:44.342317Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"USN-3012-1","title":"wget vulnerability","description":"Dawid Golunski discovered that Wget incorrectly handled filenames when\nbeing redirected from an HTTP to an FTP URL. A malicious server could\npossibly use this issue to overwrite local files.\n","status":"published","published":"2016-06-20T16:57:53Z","modified":"2026-02-10T04:41:00Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}