CVE

Id
72174  
CVE No.
CVE-2014-4877  
Status
Candidate  
Description
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.  
Phase
Assigned (20140710)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
683459 72174 CVE-2014-4877 MLIST:[bug-wget] 20141027 GNU wget 1.16 released  View
683460 72174 CVE-2014-4877 URL:http://lists.gnu.org/archive/html/bug-wget/2014-10/msg00150.html  View
683461 72174 CVE-2014-4877 MISC:https://community.rapid7.com/community/metasploit/blog/2014/10/28/r7-2014-15-gnu-wget-ftp-symlink-arbitrary-filesystem-access  View
683462 72174 CVE-2014-4877 MISC:https://github.com/rapid7/metasploit-framework/pull/4088  View
683463 72174 CVE-2014-4877 CONFIRM:http://git.savannah.gnu.org/cgit/wget.git/commit/?id=18b0979357ed7dc4e11d4f2b1d7e0f5932d82aa7  View
683464 72174 CVE-2014-4877 CONFIRM:http://git.savannah.gnu.org/cgit/wget.git/commit/?id=b4440d96cf8173d68ecaa07c36b8f4316ee794d0  View
683465 72174 CVE-2014-4877 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=1139181  View
683466 72174 CVE-2014-4877 CONFIRM:http://advisories.mageia.org/MGASA-2014-0431.html  View
683467 72174 CVE-2014-4877 CONFIRM:http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html  View
683468 72174 CVE-2014-4877 CONFIRM:https://kc.mcafee.com/corporate/index?page=content&id=SB10106  View
683469 72174 CVE-2014-4877 CONFIRM:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917  View
683470 72174 CVE-2014-4877 CONFIRM:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722  View
683471 72174 CVE-2014-4877 DEBIAN:DSA-3062  View
683472 72174 CVE-2014-4877 URL:http://www.debian.org/security/2014/dsa-3062  View
683473 72174 CVE-2014-4877 GENTOO:GLSA-201411-05  View
683474 72174 CVE-2014-4877 URL:http://security.gentoo.org/glsa/glsa-201411-05.xml  View
683475 72174 CVE-2014-4877 MANDRIVA:MDVSA-2015:121  View
683476 72174 CVE-2014-4877 URL:http://www.mandriva.com/security/advisories?name=MDVSA-2015:121  View
683477 72174 CVE-2014-4877 REDHAT:RHSA-2014:1764  View
683478 72174 CVE-2014-4877 URL:http://rhn.redhat.com/errata/RHSA-2014-1764.html  View
683479 72174 CVE-2014-4877 REDHAT:RHSA-2014:1955  View
683480 72174 CVE-2014-4877 URL:http://rhn.redhat.com/errata/RHSA-2014-1955.html  View
683481 72174 CVE-2014-4877 SUSE:SUSE-SU-2014:1366  View
683482 72174 CVE-2014-4877 URL:http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00004.html  View
683483 72174 CVE-2014-4877 SUSE:openSUSE-SU-2014:1380  View
683484 72174 CVE-2014-4877 URL:http://lists.opensuse.org/opensuse-updates/2014-11/msg00026.html  View
683485 72174 CVE-2014-4877 SUSE:SUSE-SU-2014:1408  View
683486 72174 CVE-2014-4877 URL:http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00009.html  View
683487 72174 CVE-2014-4877 UBUNTU:USN-2393-1  View
683488 72174 CVE-2014-4877 URL:http://www.ubuntu.com/usn/USN-2393-1  View
683489 72174 CVE-2014-4877 CERT-VN:VU#685996  View
683490 72174 CVE-2014-4877 URL:http://www.kb.cert.org/vuls/id/685996  View
683491 72174 CVE-2014-4877 BID:70751  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
17127 JVNDB-2014-006002 Android 用 CPWORLD Close Protection World アプリケーションにおけるサーバになりすまされる脆弱性 Android 用 CPWORLD Close Protection World (別名 com.tapatalk.closeprotectionworldcom) アプリケーションは、SSL サーバからの X.509 証明書を検証しないため、サーバになりすまされ、重要な情報を取得される脆弱性が存在します。 CVE-2014-4885 72174 5.4 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-006002.html  View