CVE-2025-69195
Wget2: gnu wget2: memory corruption and crash via filename sanitization logic with attacker-controlled urls
Résumé
Wget2: gnu wget2: memory corruption and crash via filename sanitization logic with attacker-controlled urls
Description d'origine
La description telle que publiée par la source (souvent en anglais).
A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted URL, which, upon user interaction with wget2, can lead to memory corruption. This can cause the application to crash and potentially allow for further malicious activities.
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2025-69195 wget2 Corrigé dans: 2.2.0+ds-1+deb13u1
- Ubuntu UBUNTU-CVE-2025-69195 wget2
Références
- advisory access.redhat.com
- advisory github.com
- advisory nvd.nist.gov
- package gitlab.com
- report bugzilla.redhat.com