From 9194398e76a1331b1621d0dd3b46648b90869d53 Mon Sep 17 00:00:00 2001 From: vd Date: Wed, 9 May 2018 16:15:24 +0000 Subject: Document ftp/wget's cookie injection vulnerability Submitted by: Yasuhiro KIMURA MFH: 2018Q2 Security: CVE-2018-0494 --- security/vuxml/vuln.xml | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) (limited to 'security') diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index fe6f16d79a63..3dff4de4e8bc 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,33 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + wget -- cookie injection vulnerability + + + wget + 1.19.5 + + + + +

Harry Sintonen of F-Secure Corporation reports:

+
GNU Wget is susceptible to a malicious web server injecting arbitrary cookies to the cookie jar file.
+

+ + + + https://sintonen.fi/advisories/gnu-wget-cookie-injection.txt + CVE-2018-0494 + ports/228071 + + + 2018-04-26 + 2018-05-08 + + + Flash Player -- arbitrary code execution -- cgit