According to the versions of the wget package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A stack-based and a heap-based buffer overflow flaws     were found in wget when processing chunked encoded HTTP     responses. By tricking an unsuspecting user into     connecting to a malicious HTTP server, an attacker     could exploit these flaws to potentially execute     arbitrary code. (CVE-2017-13089, CVE-2017-13090)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for wget is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols.

Security Fix(es) :

* A stack-based and a heap-based buffer overflow flaws were found in wget when processing chunked encoded HTTP responses. By tricking an unsuspecting user into connecting to a malicious HTTP server, an attacker could exploit these flaws to potentially execute arbitrary code. (CVE-2017-13089, CVE-2017-13090)

Red Hat would like to thank the GNU Wget project for reporting these issues.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the wget package has been released.

Antti Levomaki, Christian Jalio, Joonas Pihlaja :

Wget contains two vulnerabilities, a stack overflow and a heap overflow, in the handling of HTTP chunked encoding. By convincing a user to download a specific link over HTTP, an attacker may be able to execute arbitrary code with the privileges of the user.

An update of [wget] packages for PhotonOS has been released.

Heap-based buffer overflow in HTTP protocol handling

A heap-based buffer overflow, when processing chunked encoded HTTP responses, was found in wget. By tricking an unsuspecting user into connecting to a malicious HTTP server, an attacker could exploit this flaw to potentially execute arbitrary code. (CVE-2017-13090)

Stack-based buffer overflow in HTTP protocol handling

A stack-based buffer overflow when processing chunked, encoded HTTP responses was found in wget. By tricking an unsuspecting user into connecting to a malicious HTTP server, an attacker could exploit this flaw to potentially execute arbitrary code. (CVE-2017-13089)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3464-1 advisory.

    Antti Levomki, Christian Jalio, and Joonas Pihlaja discovered that Wget incorrectly handled certain HTTP     responses. A remote attacker could use this issue to cause Wget to crash, resulting in a denial of     service, or possibly execute arbitrary code. (CVE-2017-13089, CVE-2017-13090)

    Dawid Golunski discovered that Wget incorrectly handled recursive or mirroring mode. A remote attacker     could possibly use this issue to bypass intended access list restrictions. (CVE-2016-7098)

    Orange Tsai discovered that Wget incorrectly handled CRLF sequences in HTTP headers. A remote attacker     could possibly use this issue to inject arbitrary HTTP headers. (CVE-2017-6508)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201711-06 (GNU Wget: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wget. Please review the       referenced CVE identifiers for details.
  Impact :

    A remote attacker, by enticing a user to connect to a malicious server,       could remotely execute arbitrary code or cause a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

new upstream release with CVE fixes

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for wget fixes the following security issues :

  - CVE-2017-13089,CVE-2017-13090: Missing checks for     negative remaining_chunk_size in skip_short_body and     fd_read_body could cause stack-based buffer overflows,     which could have been exploited by malicious servers.
    (bsc#1064715,bsc#1064716)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for wget is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols.

Security Fix(es) :

* A stack-based and a heap-based buffer overflow flaws were found in wget when processing chunked encoded HTTP responses. By tricking an unsuspecting user into connecting to a malicious HTTP server, an attacker could exploit these flaws to potentially execute arbitrary code. (CVE-2017-13089, CVE-2017-13090)

Red Hat would like to thank the GNU Wget project for reporting these issues.

New wget packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues.

CVE-2017-13089 Fix stack overflow in HTTP protocol handling.

CVE-2017-13090 Fix heap overflow in HTTP protocol handling.

For Debian 7 'Wheezy', these problems have been fixed in version 1.13.4-3+deb7u5.

We recommend that you upgrade your wget packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
104295	EulerOS 2.0 SP2 : wget (EulerOS-SA-2017-1270)	Nessus	Huawei Local Security Checks	2017/11/1	2025/11/17	high
119236	Virtuozzo 7 : wget (VZLSA-2017-3075)	Nessus	Virtuozzo Local Security Checks	2018/11/27	2024/7/18	high
121766	Photon OS 1.0: Wget PHSA-2017-0047	Nessus	PhotonOS Local Security Checks	2019/2/7	2024/7/22	high
104228	FreeBSD : wget -- Heap overflow in HTTP protocol handling (d77ceb8c-bb13-11e7-8357-3065ec6f3643)	Nessus	FreeBSD Local Security Checks	2017/10/30	2025/11/17	high
104294	EulerOS 2.0 SP1 : wget (EulerOS-SA-2017-1269)	Nessus	Huawei Local Security Checks	2017/11/1	2025/11/17	high
111896	Photon OS 1.0: Wget PHSA-2017-0047 (deprecated)	Nessus	PhotonOS Local Security Checks	2018/8/17	2019/2/7	high
104182	Amazon Linux AMI : wget (ALAS-2017-916)	Nessus	Amazon Linux Local Security Checks	2017/10/27	2025/11/17	high
104211	Ubuntu 14.04 LTS / 16.04 LTS : Wget vulnerabilities (USN-3464-1)	Nessus	Ubuntu Local Security Checks	2017/10/27	2024/8/27	high
104514	GLSA-201711-06 : GNU Wget: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2017/11/13	2025/11/14	high
104609	Fedora 25 : wget (2017-de8a421dcd)	Nessus	Fedora Local Security Checks	2017/11/16	2025/11/14	high
104650	SUSE SLED12 / SLES12 Security Update : wget (SUSE-SU-2017:2871-2)	Nessus	SuSE Local Security Checks	2017/11/17	2025/11/13	high
104205	RHEL 7 : wget (RHSA-2017:3075)	Nessus	Red Hat Local Security Checks	2017/10/27	2025/11/17	high
104216	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : wget (SSA:2017-300-02)	Nessus	Slackware Local Security Checks	2017/10/30	2025/11/17	high
104221	Debian DLA-1149-1 : wget security update	Nessus	Debian Local Security Checks	2017/10/30	2025/11/17	high
104452	Fedora 26 : wget (2017-f0b3231763)	Nessus	Fedora Local Security Checks	2017/11/8	2025/11/14	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high