Security update for wget SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:2358-1 Final 1 1 2016-09-23T12:56:12Z current 2016-09-23T12:56:12Z 2016-09-23T12:56:12Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for wget This update for wget fixes the following issues: - CVE-2016-4971: A HTTP to FTP redirection file name confusion vulnerability was fixed. (bsc#984060). - CVE-2016-7098: A potential race condition was fixed by creating files with .tmp ext and making them accessible to the current user only. (bsc#995964) Bug fixed: - Wget failed with basicauth: Failed writing HTTP request: Bad file descriptor (bsc#958342) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). secsp3-wget-12757,sleclo50sp3-wget-12757,sleman21-wget-12757,slemap21-wget-12757,sleposp3-wget-12757,slessp3-wget-12757,slessp4-wget-12757 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20162358-1/ Link for SUSE-SU-2016:2358-1 https://lists.suse.com/pipermail/sle-security-updates/2016-September/002286.html E-Mail link for SUSE-SU-2016:2358-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/958342 SUSE Bug 958342 https://bugzilla.suse.com/984060 SUSE Bug 984060 https://bugzilla.suse.com/995964 SUSE Bug 995964 https://www.suse.com/security/cve/CVE-2016-4971/ SUSE CVE CVE-2016-4971 page https://www.suse.com/security/cve/CVE-2016-7098/ SUSE CVE CVE-2016-7098 page SUSE Linux Enterprise Point of Sale 11 SP3 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server 11-SECURITY SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Manager 2.1 SUSE Manager Proxy 2.1 SUSE OpenStack Cloud 5 wget-openssl1-1.11.4-1.32.1 wget-1.11.4-1.32.1 wget-1.11.4-1.32.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 wget-1.11.4-1.32.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS wget-openssl1-1.11.4-1.32.1 as a component of SUSE Linux Enterprise Server 11 SP3-LTSS wget-1.11.4-1.32.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA wget-openssl1-1.11.4-1.32.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA wget-1.11.4-1.32.1 as a component of SUSE Linux Enterprise Server 11 SP4 wget-openssl1-1.11.4-1.32.1 as a component of SUSE Linux Enterprise Server 11-SECURITY wget-1.11.4-1.32.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 wget-1.11.4-1.32.1 as a component of SUSE Manager 2.1 wget-1.11.4-1.32.1 as a component of SUSE Manager Proxy 2.1 wget-1.11.4-1.32.1 as a component of SUSE OpenStack Cloud 5 GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource. CVE-2016-4971 SUSE Linux Enterprise Point of Sale 11 SP3:wget-1.11.4-1.32.1 SUSE Linux Enterprise Server 11 SP3-LTSS:wget-1.11.4-1.32.1 SUSE Linux Enterprise Server 11 SP3-LTSS:wget-openssl1-1.11.4-1.32.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wget-1.11.4-1.32.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wget-openssl1-1.11.4-1.32.1 SUSE Linux Enterprise Server 11 SP4:wget-1.11.4-1.32.1 SUSE Linux Enterprise Server 11-SECURITY:wget-openssl1-1.11.4-1.32.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:wget-1.11.4-1.32.1 SUSE Manager 2.1:wget-1.11.4-1.32.1 SUSE Manager Proxy 2.1:wget-1.11.4-1.32.1 SUSE OpenStack Cloud 5:wget-1.11.4-1.32.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162358-1/ https://www.suse.com/security/cve/CVE-2016-4971.html CVE-2016-4971 https://bugzilla.suse.com/1023231 SUSE Bug 1023231 https://bugzilla.suse.com/984060 SUSE Bug 984060 Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass intended access list restrictions by keeping an HTTP connection open. CVE-2016-7098 SUSE Linux Enterprise Point of Sale 11 SP3:wget-1.11.4-1.32.1 SUSE Linux Enterprise Server 11 SP3-LTSS:wget-1.11.4-1.32.1 SUSE Linux Enterprise Server 11 SP3-LTSS:wget-openssl1-1.11.4-1.32.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wget-1.11.4-1.32.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:wget-openssl1-1.11.4-1.32.1 SUSE Linux Enterprise Server 11 SP4:wget-1.11.4-1.32.1 SUSE Linux Enterprise Server 11-SECURITY:wget-openssl1-1.11.4-1.32.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:wget-1.11.4-1.32.1 SUSE Manager 2.1:wget-1.11.4-1.32.1 SUSE Manager Proxy 2.1:wget-1.11.4-1.32.1 SUSE OpenStack Cloud 5:wget-1.11.4-1.32.1 moderate 2.6 AV:N/AC:H/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20162358-1/ https://www.suse.com/security/cve/CVE-2016-7098.html CVE-2016-7098 https://bugzilla.suse.com/995964 SUSE Bug 995964