CVE-2004-1488
NoneCVSS
—
EPSS
11.9%
Published
Apr 27, 2005
CISA due date
—
The record
wget 1.8.x and 1.9.x does not filter or quote control characters when displaying HTTP responses to the terminal, which may allow remote malicious web servers to inject terminal escape sequences and execute arbitrary code.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | wget | 0 | 1.9.1-11 |
| Debian:12 | wget | 0 | 1.9.1-11 |
| Debian:13 | wget | 0 | 1.9.1-11 |
| Red Hat:enterprise_linux:3::as | wget | 0 | 0:1.10.1-1.30E.1 |
| Red Hat:enterprise_linux:3::as | wget-debuginfo | 0 | 0:1.10.1-1.30E.1 |
| Red Hat:enterprise_linux:3::desktop | wget | 0 | 0:1.10.1-1.30E.1 |
| Red Hat:enterprise_linux:3::desktop | wget-debuginfo | 0 | 0:1.10.1-1.30E.1 |
| Red Hat:enterprise_linux:3::es | wget | 0 | 0:1.10.1-1.30E.1 |
| Red Hat:enterprise_linux:3::es | wget-debuginfo | 0 | 0:1.10.1-1.30E.1 |
| Red Hat:enterprise_linux:3::ws | wget | 0 | 0:1.10.1-1.30E.1 |
| Red Hat:enterprise_linux:3::ws | wget-debuginfo | 0 | 0:1.10.1-1.30E.1 |
| Red Hat:enterprise_linux:4::as | wget | 0 | 0:1.10.1-2.4E.1 |
| Red Hat:enterprise_linux:4::as | wget-debuginfo | 0 | 0:1.10.1-2.4E.1 |
| Red Hat:enterprise_linux:4::desktop | wget | 0 | 0:1.10.1-2.4E.1 |
| Red Hat:enterprise_linux:4::desktop | wget-debuginfo | 0 | 0:1.10.1-2.4E.1 |
| Red Hat:enterprise_linux:4::es | wget | 0 | 0:1.10.1-2.4E.1 |
| Red Hat:enterprise_linux:4::es | wget-debuginfo | 0 | 0:1.10.1-2.4E.1 |
| Red Hat:enterprise_linux:4::ws | wget | 0 | 0:1.10.1-2.4E.1 |
| Red Hat:enterprise_linux:4::ws | wget-debuginfo | 0 | 0:1.10.1-2.4E.1 |
Related vulnerabilities
- CVE-2024-10524 Applications that use Wget to access a remote resource using shorthand URLs and pass… Also affects wget
- CVE-2024-38428 url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a… Also affects wget
- CVE-2017-13089 The http.c:skip_short_body() function is called in some circumstances, such as when… Also affects wget
- CVE-2017-13090 The retr.c:fd_read_body() function is called when processing OK responses. Also affects wget
- CVE-2016-7098 Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to… Also affects wget
- CVE-2016-4971 GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a… Also affects wget
- CVE-2014-4877 Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled… Also affects wget