CVE-2017-13090

The record

The retr.c:fd_read_body() function is called when processing OK responses. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to read the chunk in pieces of 8192 bytes by using the MIN() macro, but ends up passing the negative chunk length to retr.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument. The attacker can corrupt malloc metadata after the allocated buffer.

Affected packages

Related vulnerabilities

• CVE-2024-10524 Applications that use Wget to access a remote resource using shorthand URLs and pass… Also affects wget
• CVE-2017-13089 The http.c:skip_short_body() function is called in some circumstances, such as when… Also affects wget
• CVE-2016-4971 GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a… Also affects wget
• CVE-2024-38428 url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a… Also affects wget
• CVE-2016-7098 Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to… Also affects wget
• CVE-2014-4877 Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled… Also affects wget
• CVE-2004-1488 wget 1.8.x and 1.9.x does not filter or quote control characters when displaying HTTP… Also affects wget
• CVE-2015-2059 The stringprep_utf8_to_ucs4 function in libin before 1.31, as used in jabberd2, allows… Also affects wget