CyberRota Analysis
AI-GeneratedGNU Wget versions up to 1.25.0 are vulnerable to a heap buffer underread in the clean_metalink_string() function, which can be exploited by a malicious server serving a whitespace-only URL in a Metalink document. This vulnerability can lead to memory corruption and abnormal program behavior, posing a significant risk to systems utilizing affected versions of Wget. Organizations using this tool should prioritize patching to mitigate potential exploitation risks.
Original NVD Description
GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean_metalink_string() function within src/metalink.c that allows a malicious server to trigger memory corruption by serving a Metalink document containing a whitespace-only URL. Attackers can cause the function to decrement a pointer past the start of the buffer when processing an all-whitespace Metalink URL, potentially leading to abnormal program behavior.
Related CVEs
Other vulnerabilities affecting the same vendor(s)