CVE-2016-4971 (HIGH 8.8) · Watchpost

← All vulnerabilities

CVE-2016-4971

HIGH 8.8CVE-2016-4971 · Published 30/06/2016 · updated 17/06/2026

Package	Affected versions	Patched versions
wget gnu	`< 1.18`	`1.18`

Description

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.

References

git.savannah.gnu.org/cgit/wget.git/commit · Patch
lists.gnu.org/archive/html/info-gnu/2016-06/msg00004.html · Mailing List
lists.opensuse.org/opensuse-updates/2016-08/msg00043.html · Broken Link
packetstormsecurity.com/files/162395/GNU-wget-Arbitrary-File-Upload-Code-Execution.html · Exploit
rhn.redhat.com/errata/RHSA-2016-2587.html · Broken Link
oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html · Third Party Advisory
securityfocus.com/bid/91530 · Third Party Advisory
securitytracker.com/id/1036133 · Third Party Advisory
ubuntu.com/usn/USN-3012-1 · Third Party Advisory
bugzilla.redhat.com/show_bug.cgi · Exploit
security.gentoo.org/glsa/201610-11 · Third Party Advisory
security.paloaltonetworks.com/CVE-2016-4971 · Third Party Advisory
exploit-db.com/exploits/40064 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free