Date:         Mon, 3 Nov 2014 17:52:32 +0000
Reply-To:     scientific-linux-users@listserv.fnal.gov
Sender:       Security Errata for Scientific Linux
              
From:         Pat Riehecky 
Subject:      Security ERRATA Moderate: wget on SL6.x, SL7.x i386/x86_64
MIME-Version: 1.0

Synopsis:          Moderate: wget security update
Advisory ID:       SLSA-2014:1764-1
Issue Date:        2014-10-30
CVE Numbers:       CVE-2014-4877
--

A flaw was found in the way Wget handled symbolic links. A malicious FTP
server could allow Wget running in the mirror mode (using the '-m' command
line option) to write an arbitrary file to a location writable to by the
user running Wget, possibly leading to code execution. (CVE-2014-4877)

Note: This update changes the default value of the --retr-symlinks option.
The file symbolic links are now traversed by default and pointed-to files
are retrieved rather than creating a symbolic link locally.
--

SL6
  x86_64
    wget-1.12-5.el6_6.1.x86_64.rpm
    wget-debuginfo-1.12-5.el6_6.1.x86_64.rpm
  i386
    wget-1.12-5.el6_6.1.i686.rpm
    wget-debuginfo-1.12-5.el6_6.1.i686.rpm
SL7
  x86_64
    wget-1.14-10.el7_0.1.x86_64.rpm
    wget-debuginfo-1.14-10.el7_0.1.x86_64.rpm

- Scientific Linux Development Team