csaf_redhat - rhsa-2014

rhsa-2014_1955

Vulnerability from csaf_redhat

Published

2014-12-03 17:21

Modified

2024-11-22 08:38

Summary

Red Hat Security Advisory: wget security update

Notes

Topic

An updated wget package that fixes one security issue is now available for Red Hat Enterprise Linux 6.5 Extended Update Support. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Details

The wget package provides the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols. A flaw was found in the way Wget handled symbolic links. A malicious FTP server could allow Wget running in the mirror mode (using the '-m' command line option) to write an arbitrary file to a location writable to by the user running Wget, possibly leading to code execution. (CVE-2014-4877) Note: This update changes the default value of the --retr-symlinks option. The file symbolic links are now traversed by default and pointed-to files are retrieved rather than creating a symbolic link locally. Red Hat would like to thank the GNU Wget project for reporting this issue. Upstream acknowledges HD Moore of Rapid7, Inc as the original reporter. All users of wget are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated wget package that fixes one security issue is now available for\nRed Hat Enterprise Linux 6.5 Extended Update Support.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The wget package provides the GNU Wget file retrieval utility for HTTP,\nHTTPS, and FTP protocols.\n\nA flaw was found in the way Wget handled symbolic links. A malicious FTP\nserver could allow Wget running in the mirror mode (using the \u0027-m\u0027 command\nline option) to write an arbitrary file to a location writable to by the\nuser running Wget, possibly leading to code execution. (CVE-2014-4877)\n\nNote: This update changes the default value of the --retr-symlinks option.\nThe file symbolic links are now traversed by default and pointed-to files\nare retrieved rather than creating a symbolic link locally.\n\nRed Hat would like to thank the GNU Wget project for reporting this issue.\nUpstream acknowledges HD Moore of Rapid7, Inc as the original reporter.\n\nAll users of wget are advised to upgrade to this updated package, which\ncontains a backported patch to correct this issue.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:1955",
        "url": "https://access.redhat.com/errata/RHSA-2014:1955"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "1139181",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1139181"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1955.json"
      }
    ],
    "title": "Red Hat Security Advisory: wget security update",
    "tracking": {
      "current_release_date": "2024-11-22T08:38:42+00:00",
      "generator": {
        "date": "2024-11-22T08:38:42+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2014:1955",
      "initial_release_date": "2014-12-03T17:21:40+00:00",
      "revision_history": [
        {
          "date": "2014-12-03T17:21:40+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2014-12-03T17:21:40+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T08:38:42+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux HPC Node EUS (v. 6.5)",
                "product": {
                  "name": "Red Hat Enterprise Linux HPC Node EUS (v. 6.5)",
                  "product_id": "6ComputeNode-6.5.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_eus:6.5::computenode"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server EUS (v. 6.5)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server EUS (v. 6.5)",
                  "product_id": "6Server-6.5.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_eus:6.5::server"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "wget-0:1.12-1.12.el6_5.x86_64",
                "product": {
                  "name": "wget-0:1.12-1.12.el6_5.x86_64",
                  "product_id": "wget-0:1.12-1.12.el6_5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/wget@1.12-1.12.el6_5?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "wget-debuginfo-0:1.12-1.12.el6_5.x86_64",
                "product": {
                  "name": "wget-debuginfo-0:1.12-1.12.el6_5.x86_64",
                  "product_id": "wget-debuginfo-0:1.12-1.12.el6_5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/wget-debuginfo@1.12-1.12.el6_5?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "wget-0:1.12-1.12.el6_5.src",
                "product": {
                  "name": "wget-0:1.12-1.12.el6_5.src",
                  "product_id": "wget-0:1.12-1.12.el6_5.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/wget@1.12-1.12.el6_5?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "wget-0:1.12-1.12.el6_5.ppc64",
                "product": {
                  "name": "wget-0:1.12-1.12.el6_5.ppc64",
                  "product_id": "wget-0:1.12-1.12.el6_5.ppc64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/wget@1.12-1.12.el6_5?arch=ppc64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "wget-debuginfo-0:1.12-1.12.el6_5.ppc64",
                "product": {
                  "name": "wget-debuginfo-0:1.12-1.12.el6_5.ppc64",
                  "product_id": "wget-debuginfo-0:1.12-1.12.el6_5.ppc64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/wget-debuginfo@1.12-1.12.el6_5?arch=ppc64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "wget-0:1.12-1.12.el6_5.s390x",
                "product": {
                  "name": "wget-0:1.12-1.12.el6_5.s390x",
                  "product_id": "wget-0:1.12-1.12.el6_5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/wget@1.12-1.12.el6_5?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "wget-debuginfo-0:1.12-1.12.el6_5.s390x",
                "product": {
                  "name": "wget-debuginfo-0:1.12-1.12.el6_5.s390x",
                  "product_id": "wget-debuginfo-0:1.12-1.12.el6_5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/wget-debuginfo@1.12-1.12.el6_5?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "wget-0:1.12-1.12.el6_5.i686",
                "product": {
                  "name": "wget-0:1.12-1.12.el6_5.i686",
                  "product_id": "wget-0:1.12-1.12.el6_5.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/wget@1.12-1.12.el6_5?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "wget-debuginfo-0:1.12-1.12.el6_5.i686",
                "product": {
                  "name": "wget-debuginfo-0:1.12-1.12.el6_5.i686",
                  "product_id": "wget-debuginfo-0:1.12-1.12.el6_5.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/wget-debuginfo@1.12-1.12.el6_5?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-0:1.12-1.12.el6_5.i686 as a component of Red Hat Enterprise Linux HPC Node EUS (v. 6.5)",
          "product_id": "6ComputeNode-6.5.EUS:wget-0:1.12-1.12.el6_5.i686"
        },
        "product_reference": "wget-0:1.12-1.12.el6_5.i686",
        "relates_to_product_reference": "6ComputeNode-6.5.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-0:1.12-1.12.el6_5.ppc64 as a component of Red Hat Enterprise Linux HPC Node EUS (v. 6.5)",
          "product_id": "6ComputeNode-6.5.EUS:wget-0:1.12-1.12.el6_5.ppc64"
        },
        "product_reference": "wget-0:1.12-1.12.el6_5.ppc64",
        "relates_to_product_reference": "6ComputeNode-6.5.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-0:1.12-1.12.el6_5.s390x as a component of Red Hat Enterprise Linux HPC Node EUS (v. 6.5)",
          "product_id": "6ComputeNode-6.5.EUS:wget-0:1.12-1.12.el6_5.s390x"
        },
        "product_reference": "wget-0:1.12-1.12.el6_5.s390x",
        "relates_to_product_reference": "6ComputeNode-6.5.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-0:1.12-1.12.el6_5.src as a component of Red Hat Enterprise Linux HPC Node EUS (v. 6.5)",
          "product_id": "6ComputeNode-6.5.EUS:wget-0:1.12-1.12.el6_5.src"
        },
        "product_reference": "wget-0:1.12-1.12.el6_5.src",
        "relates_to_product_reference": "6ComputeNode-6.5.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-0:1.12-1.12.el6_5.x86_64 as a component of Red Hat Enterprise Linux HPC Node EUS (v. 6.5)",
          "product_id": "6ComputeNode-6.5.EUS:wget-0:1.12-1.12.el6_5.x86_64"
        },
        "product_reference": "wget-0:1.12-1.12.el6_5.x86_64",
        "relates_to_product_reference": "6ComputeNode-6.5.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-debuginfo-0:1.12-1.12.el6_5.i686 as a component of Red Hat Enterprise Linux HPC Node EUS (v. 6.5)",
          "product_id": "6ComputeNode-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.i686"
        },
        "product_reference": "wget-debuginfo-0:1.12-1.12.el6_5.i686",
        "relates_to_product_reference": "6ComputeNode-6.5.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-debuginfo-0:1.12-1.12.el6_5.ppc64 as a component of Red Hat Enterprise Linux HPC Node EUS (v. 6.5)",
          "product_id": "6ComputeNode-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.ppc64"
        },
        "product_reference": "wget-debuginfo-0:1.12-1.12.el6_5.ppc64",
        "relates_to_product_reference": "6ComputeNode-6.5.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-debuginfo-0:1.12-1.12.el6_5.s390x as a component of Red Hat Enterprise Linux HPC Node EUS (v. 6.5)",
          "product_id": "6ComputeNode-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.s390x"
        },
        "product_reference": "wget-debuginfo-0:1.12-1.12.el6_5.s390x",
        "relates_to_product_reference": "6ComputeNode-6.5.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-debuginfo-0:1.12-1.12.el6_5.x86_64 as a component of Red Hat Enterprise Linux HPC Node EUS (v. 6.5)",
          "product_id": "6ComputeNode-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.x86_64"
        },
        "product_reference": "wget-debuginfo-0:1.12-1.12.el6_5.x86_64",
        "relates_to_product_reference": "6ComputeNode-6.5.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-0:1.12-1.12.el6_5.i686 as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)",
          "product_id": "6Server-6.5.EUS:wget-0:1.12-1.12.el6_5.i686"
        },
        "product_reference": "wget-0:1.12-1.12.el6_5.i686",
        "relates_to_product_reference": "6Server-6.5.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-0:1.12-1.12.el6_5.ppc64 as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)",
          "product_id": "6Server-6.5.EUS:wget-0:1.12-1.12.el6_5.ppc64"
        },
        "product_reference": "wget-0:1.12-1.12.el6_5.ppc64",
        "relates_to_product_reference": "6Server-6.5.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-0:1.12-1.12.el6_5.s390x as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)",
          "product_id": "6Server-6.5.EUS:wget-0:1.12-1.12.el6_5.s390x"
        },
        "product_reference": "wget-0:1.12-1.12.el6_5.s390x",
        "relates_to_product_reference": "6Server-6.5.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-0:1.12-1.12.el6_5.src as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)",
          "product_id": "6Server-6.5.EUS:wget-0:1.12-1.12.el6_5.src"
        },
        "product_reference": "wget-0:1.12-1.12.el6_5.src",
        "relates_to_product_reference": "6Server-6.5.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-0:1.12-1.12.el6_5.x86_64 as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)",
          "product_id": "6Server-6.5.EUS:wget-0:1.12-1.12.el6_5.x86_64"
        },
        "product_reference": "wget-0:1.12-1.12.el6_5.x86_64",
        "relates_to_product_reference": "6Server-6.5.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-debuginfo-0:1.12-1.12.el6_5.i686 as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)",
          "product_id": "6Server-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.i686"
        },
        "product_reference": "wget-debuginfo-0:1.12-1.12.el6_5.i686",
        "relates_to_product_reference": "6Server-6.5.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-debuginfo-0:1.12-1.12.el6_5.ppc64 as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)",
          "product_id": "6Server-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.ppc64"
        },
        "product_reference": "wget-debuginfo-0:1.12-1.12.el6_5.ppc64",
        "relates_to_product_reference": "6Server-6.5.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-debuginfo-0:1.12-1.12.el6_5.s390x as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)",
          "product_id": "6Server-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.s390x"
        },
        "product_reference": "wget-debuginfo-0:1.12-1.12.el6_5.s390x",
        "relates_to_product_reference": "6Server-6.5.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "wget-debuginfo-0:1.12-1.12.el6_5.x86_64 as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)",
          "product_id": "6Server-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.x86_64"
        },
        "product_reference": "wget-debuginfo-0:1.12-1.12.el6_5.x86_64",
        "relates_to_product_reference": "6Server-6.5.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "GNU Wget project"
          ]
        }
      ],
      "cve": "CVE-2014-4877",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
      },
      "discovery_date": "2014-09-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1139181"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the way Wget handled symbolic links. A malicious FTP server could allow Wget running in the mirror mode (using the \u0027-m\u0027 command line option) to write an arbitrary file to a location writable to by the user running Wget, possibly leading to code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "wget: FTP symlink arbitrary filesystem access",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6ComputeNode-6.5.EUS:wget-0:1.12-1.12.el6_5.i686",
          "6ComputeNode-6.5.EUS:wget-0:1.12-1.12.el6_5.ppc64",
          "6ComputeNode-6.5.EUS:wget-0:1.12-1.12.el6_5.s390x",
          "6ComputeNode-6.5.EUS:wget-0:1.12-1.12.el6_5.src",
          "6ComputeNode-6.5.EUS:wget-0:1.12-1.12.el6_5.x86_64",
          "6ComputeNode-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.i686",
          "6ComputeNode-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.ppc64",
          "6ComputeNode-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.s390x",
          "6ComputeNode-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.x86_64",
          "6Server-6.5.EUS:wget-0:1.12-1.12.el6_5.i686",
          "6Server-6.5.EUS:wget-0:1.12-1.12.el6_5.ppc64",
          "6Server-6.5.EUS:wget-0:1.12-1.12.el6_5.s390x",
          "6Server-6.5.EUS:wget-0:1.12-1.12.el6_5.src",
          "6Server-6.5.EUS:wget-0:1.12-1.12.el6_5.x86_64",
          "6Server-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.i686",
          "6Server-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.ppc64",
          "6Server-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.s390x",
          "6Server-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-4877"
        },
        {
          "category": "external",
          "summary": "RHBZ#1139181",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1139181"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-4877",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-4877"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-4877",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4877"
        }
      ],
      "release_date": "2014-10-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-12-03T17:21:40+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6ComputeNode-6.5.EUS:wget-0:1.12-1.12.el6_5.i686",
            "6ComputeNode-6.5.EUS:wget-0:1.12-1.12.el6_5.ppc64",
            "6ComputeNode-6.5.EUS:wget-0:1.12-1.12.el6_5.s390x",
            "6ComputeNode-6.5.EUS:wget-0:1.12-1.12.el6_5.src",
            "6ComputeNode-6.5.EUS:wget-0:1.12-1.12.el6_5.x86_64",
            "6ComputeNode-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.i686",
            "6ComputeNode-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.ppc64",
            "6ComputeNode-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.s390x",
            "6ComputeNode-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.x86_64",
            "6Server-6.5.EUS:wget-0:1.12-1.12.el6_5.i686",
            "6Server-6.5.EUS:wget-0:1.12-1.12.el6_5.ppc64",
            "6Server-6.5.EUS:wget-0:1.12-1.12.el6_5.s390x",
            "6Server-6.5.EUS:wget-0:1.12-1.12.el6_5.src",
            "6Server-6.5.EUS:wget-0:1.12-1.12.el6_5.x86_64",
            "6Server-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.i686",
            "6Server-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.ppc64",
            "6Server-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.s390x",
            "6Server-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:1955"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "6ComputeNode-6.5.EUS:wget-0:1.12-1.12.el6_5.i686",
            "6ComputeNode-6.5.EUS:wget-0:1.12-1.12.el6_5.ppc64",
            "6ComputeNode-6.5.EUS:wget-0:1.12-1.12.el6_5.s390x",
            "6ComputeNode-6.5.EUS:wget-0:1.12-1.12.el6_5.src",
            "6ComputeNode-6.5.EUS:wget-0:1.12-1.12.el6_5.x86_64",
            "6ComputeNode-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.i686",
            "6ComputeNode-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.ppc64",
            "6ComputeNode-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.s390x",
            "6ComputeNode-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.x86_64",
            "6Server-6.5.EUS:wget-0:1.12-1.12.el6_5.i686",
            "6Server-6.5.EUS:wget-0:1.12-1.12.el6_5.ppc64",
            "6Server-6.5.EUS:wget-0:1.12-1.12.el6_5.s390x",
            "6Server-6.5.EUS:wget-0:1.12-1.12.el6_5.src",
            "6Server-6.5.EUS:wget-0:1.12-1.12.el6_5.x86_64",
            "6Server-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.i686",
            "6Server-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.ppc64",
            "6Server-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.s390x",
            "6Server-6.5.EUS:wget-debuginfo-0:1.12-1.12.el6_5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "wget: FTP symlink arbitrary filesystem access"
    }
  ]
}

cve-2014-4877

Vulnerability from cvelistv5

Published

2014-10-29 10:00

Modified

2024-08-06 11:27

Severity ?

Summary

Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.

References

▼	URL	Tags
	http://git.savannah.gnu.org/cgit/wget.git/commit/?id=b4440d96cf8173d68ecaa07c36b8f4316ee794d0	x_refsource_CONFIRM
	http://security.gentoo.org/glsa/glsa-201411-05.xml	vendor-advisory, x_refsource_GENTOO
	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917	x_refsource_CONFIRM
	http://lists.gnu.org/archive/html/bug-wget/2014-10/msg00150.html	mailing-list, x_refsource_MLIST
	http://www.ubuntu.com/usn/USN-2393-1	vendor-advisory, x_refsource_UBUNTU
	http://www.mandriva.com/security/advisories?name=MDVSA-2015:121	vendor-advisory, x_refsource_MANDRIVA
	http://rhn.redhat.com/errata/RHSA-2014-1955.html	vendor-advisory, x_refsource_REDHAT
	http://www.debian.org/security/2014/dsa-3062	vendor-advisory, x_refsource_DEBIAN
	http://git.savannah.gnu.org/cgit/wget.git/commit/?id=18b0979357ed7dc4e11d4f2b1d7e0f5932d82aa7	x_refsource_CONFIRM
	http://www.kb.cert.org/vuls/id/685996	third-party-advisory, x_refsource_CERT-VN
	http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00004.html	vendor-advisory, x_refsource_SUSE
	http://rhn.redhat.com/errata/RHSA-2014-1764.html	vendor-advisory, x_refsource_REDHAT
	http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00009.html	vendor-advisory, x_refsource_SUSE
	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-updates/2014-11/msg00026.html	vendor-advisory, x_refsource_SUSE
	https://bugzilla.redhat.com/show_bug.cgi?id=1139181	x_refsource_CONFIRM
	https://community.rapid7.com/community/metasploit/blog/2014/10/28/r7-2014-15-gnu-wget-ftp-symlink-arbitrary-filesystem-access	x_refsource_MISC
	http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/70751	vdb-entry, x_refsource_BID
	https://kc.mcafee.com/corporate/index?page=content&id=SB10106	x_refsource_CONFIRM
	http://advisories.mageia.org/MGASA-2014-0431.html	x_refsource_CONFIRM
	https://github.com/rapid7/metasploit-framework/pull/4088	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

n/a

Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T11:27:36.989Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.savannah.gnu.org/cgit/wget.git/commit/?id=b4440d96cf8173d68ecaa07c36b8f4316ee794d0"
          },
          {
            "name": "GLSA-201411-05",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-201411-05.xml"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917"
          },
          {
            "name": "[bug-wget] 20141027 GNU wget 1.16 released",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.gnu.org/archive/html/bug-wget/2014-10/msg00150.html"
          },
          {
            "name": "USN-2393-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2393-1"
          },
          {
            "name": "MDVSA-2015:121",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:121"
          },
          {
            "name": "RHSA-2014:1955",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2014-1955.html"
          },
          {
            "name": "DSA-3062",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-3062"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.savannah.gnu.org/cgit/wget.git/commit/?id=18b0979357ed7dc4e11d4f2b1d7e0f5932d82aa7"
          },
          {
            "name": "VU#685996",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/685996"
          },
          {
            "name": "SUSE-SU-2014:1366",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00004.html"
          },
          {
            "name": "RHSA-2014:1764",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2014-1764.html"
          },
          {
            "name": "SUSE-SU-2014:1408",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00009.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722"
          },
          {
            "name": "openSUSE-SU-2014:1380",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00026.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1139181"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://community.rapid7.com/community/metasploit/blog/2014/10/28/r7-2014-15-gnu-wget-ftp-symlink-arbitrary-filesystem-access"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html"
          },
          {
            "name": "70751",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/70751"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10106"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://advisories.mageia.org/MGASA-2014-0431.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rapid7/metasploit-framework/pull/4088"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-10-27T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-02-16T10:57:01",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.savannah.gnu.org/cgit/wget.git/commit/?id=b4440d96cf8173d68ecaa07c36b8f4316ee794d0"
        },
        {
          "name": "GLSA-201411-05",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-201411-05.xml"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917"
        },
        {
          "name": "[bug-wget] 20141027 GNU wget 1.16 released",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.gnu.org/archive/html/bug-wget/2014-10/msg00150.html"
        },
        {
          "name": "USN-2393-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2393-1"
        },
        {
          "name": "MDVSA-2015:121",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:121"
        },
        {
          "name": "RHSA-2014:1955",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2014-1955.html"
        },
        {
          "name": "DSA-3062",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-3062"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.savannah.gnu.org/cgit/wget.git/commit/?id=18b0979357ed7dc4e11d4f2b1d7e0f5932d82aa7"
        },
        {
          "name": "VU#685996",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/685996"
        },
        {
          "name": "SUSE-SU-2014:1366",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00004.html"
        },
        {
          "name": "RHSA-2014:1764",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2014-1764.html"
        },
        {
          "name": "SUSE-SU-2014:1408",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00009.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722"
        },
        {
          "name": "openSUSE-SU-2014:1380",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00026.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1139181"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://community.rapid7.com/community/metasploit/blog/2014/10/28/r7-2014-15-gnu-wget-ftp-symlink-arbitrary-filesystem-access"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html"
        },
        {
          "name": "70751",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/70751"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10106"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://advisories.mageia.org/MGASA-2014-0431.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rapid7/metasploit-framework/pull/4088"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cert@cert.org",
          "ID": "CVE-2014-4877",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://git.savannah.gnu.org/cgit/wget.git/commit/?id=b4440d96cf8173d68ecaa07c36b8f4316ee794d0",
              "refsource": "CONFIRM",
              "url": "http://git.savannah.gnu.org/cgit/wget.git/commit/?id=b4440d96cf8173d68ecaa07c36b8f4316ee794d0"
            },
            {
              "name": "GLSA-201411-05",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-201411-05.xml"
            },
            {
              "name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917",
              "refsource": "CONFIRM",
              "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917"
            },
            {
              "name": "[bug-wget] 20141027 GNU wget 1.16 released",
              "refsource": "MLIST",
              "url": "http://lists.gnu.org/archive/html/bug-wget/2014-10/msg00150.html"
            },
            {
              "name": "USN-2393-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2393-1"
            },
            {
              "name": "MDVSA-2015:121",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:121"
            },
            {
              "name": "RHSA-2014:1955",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2014-1955.html"
            },
            {
              "name": "DSA-3062",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2014/dsa-3062"
            },
            {
              "name": "http://git.savannah.gnu.org/cgit/wget.git/commit/?id=18b0979357ed7dc4e11d4f2b1d7e0f5932d82aa7",
              "refsource": "CONFIRM",
              "url": "http://git.savannah.gnu.org/cgit/wget.git/commit/?id=18b0979357ed7dc4e11d4f2b1d7e0f5932d82aa7"
            },
            {
              "name": "VU#685996",
              "refsource": "CERT-VN",
              "url": "http://www.kb.cert.org/vuls/id/685996"
            },
            {
              "name": "SUSE-SU-2014:1366",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00004.html"
            },
            {
              "name": "RHSA-2014:1764",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2014-1764.html"
            },
            {
              "name": "SUSE-SU-2014:1408",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00009.html"
            },
            {
              "name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722",
              "refsource": "CONFIRM",
              "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722"
            },
            {
              "name": "openSUSE-SU-2014:1380",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00026.html"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1139181",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1139181"
            },
            {
              "name": "https://community.rapid7.com/community/metasploit/blog/2014/10/28/r7-2014-15-gnu-wget-ftp-symlink-arbitrary-filesystem-access",
              "refsource": "MISC",
              "url": "https://community.rapid7.com/community/metasploit/blog/2014/10/28/r7-2014-15-gnu-wget-ftp-symlink-arbitrary-filesystem-access"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html"
            },
            {
              "name": "70751",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/70751"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10106",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10106"
            },
            {
              "name": "http://advisories.mageia.org/MGASA-2014-0431.html",
              "refsource": "CONFIRM",
              "url": "http://advisories.mageia.org/MGASA-2014-0431.html"
            },
            {
              "name": "https://github.com/rapid7/metasploit-framework/pull/4088",
              "refsource": "MISC",
              "url": "https://github.com/rapid7/metasploit-framework/pull/4088"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2014-4877",
    "datePublished": "2014-10-29T10:00:00",
    "dateReserved": "2014-07-10T00:00:00",
    "dateUpdated": "2024-08-06T11:27:36.989Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted