CVE-2004-1488
NoneCVSS
—
EPSS
11.9%
Published
Apr 27, 2005
CISA due date
—
The record
wget 1.8.x and 1.9.x does not filter or quote control characters when displaying HTTP responses to the terminal, which may allow remote malicious web servers to inject terminal escape sequences and execute arbitrary code.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | wget | 0 | 1.9.1-11 |
| Debian:12 | wget | 0 | 1.9.1-11 |
| Debian:13 | wget | 0 | 1.9.1-11 |
| Red Hat:enterprise_linux:3::as | wget | 0 | 0:1.10.1-1.30E.1 |
| Red Hat:enterprise_linux:3::as | wget-debuginfo | 0 | 0:1.10.1-1.30E.1 |
| Red Hat:enterprise_linux:3::desktop | wget | 0 | 0:1.10.1-1.30E.1 |
| Red Hat:enterprise_linux:3::desktop | wget-debuginfo | 0 | 0:1.10.1-1.30E.1 |
| Red Hat:enterprise_linux:3::es | wget | 0 | 0:1.10.1-1.30E.1 |
| Red Hat:enterprise_linux:3::es | wget-debuginfo | 0 | 0:1.10.1-1.30E.1 |
| Red Hat:enterprise_linux:3::ws | wget | 0 | 0:1.10.1-1.30E.1 |
| Red Hat:enterprise_linux:3::ws | wget-debuginfo | 0 | 0:1.10.1-1.30E.1 |
| Red Hat:enterprise_linux:4::as | wget | 0 | 0:1.10.1-2.4E.1 |
| Red Hat:enterprise_linux:4::as | wget-debuginfo | 0 | 0:1.10.1-2.4E.1 |
| Red Hat:enterprise_linux:4::desktop | wget | 0 | 0:1.10.1-2.4E.1 |
| Red Hat:enterprise_linux:4::desktop | wget-debuginfo | 0 | 0:1.10.1-2.4E.1 |
| Red Hat:enterprise_linux:4::es | wget | 0 | 0:1.10.1-2.4E.1 |
| Red Hat:enterprise_linux:4::es | wget-debuginfo | 0 | 0:1.10.1-2.4E.1 |
| Red Hat:enterprise_linux:4::ws | wget | 0 | 0:1.10.1-2.4E.1 |
| Red Hat:enterprise_linux:4::ws | wget-debuginfo | 0 | 0:1.10.1-2.4E.1 |
Related vulnerabilities
- CVE-2017-13089 The http.c:skip_short_body() function is called in some circumstances, such as when… Also affects wget
- CVE-2017-13090 The retr.c:fd_read_body() function is called when processing OK responses. Also affects wget
- CVE-2016-4971 GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a… Also affects wget
- CVE-2014-4877 Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled… Also affects wget