Buffer overflow in wget - CVE-2019-5953

Vulnerability identifier: #VU18143

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-5953

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when handling Internationalized Resource Identifiers (IRI) during recursive downloading. A remote attacker can trick the victim to connect to a malicious web server, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

wget
Amazon Linux AMI
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power
Slackware Linux
Opensuse
Fedora
wget (Debian package)
wget (Alpine package)
wget (Ubuntu package)
wget
Red Hat Virtualization Host
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)

Install updates from vendor's website.

wget - update to 1.20.2
wget (Debian package) - update to 1.18-5+deb9u3
wget (Alpine package) - update to 1.20.3-r0
wget (Ubuntu package) - addressed in versions 1.15-1ubuntu1.14.04.5, 1.17.1-1ubuntu1.5, 1.19.4-1ubuntu2.2, 1.19.5-1ubuntu1.1
wget - addressed in versions 1.20.3-1.fc28, 1.20.3-1.fc29, 1.20.3-1.fc30
Dell EMC Unity Operating Environment (OE) - update to 5.0.3.0.5.014
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.3.0.5.014

• https://git.savannah.gnu.org/cgit/wget.git/commit/?id=692d5c5215de0db482c252492a92fc424cc6a97c
• https://git.savannah.gnu.org/cgit/wget.git/commit/?id=562eacb76a2b64d5dc80a443f0f739bc9ef76c17
• https://lists.gnu.org/archive/html/bug-wget/2019-04/msg00012.html

• Buffer overflow in GNU wget
• Debian update for wget
• Ubuntu update for Wget
• OpenSUSE Linux update for wget
• OpenSUSE Linux update for wget
• Slackware Linux update for wget
• Amazon Linux AMI update for wget
• Red Hat update for wget
• Gentoo update for GNU Wget
• Red Hat update for wget
• Red Hat update for wget
• Red Hat update for wget
• Buffer overflow in wget (Alpine package)
• Fedora 29 update for wget
• Fedora 30 update for wget
• Fedora 28 update for wget
• Dell EMC Unity update for third-party components