SUSE-SU-2026:3148-1

Details

Description of the patch:

This update for wget fixes the following issues:

CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery (bsc#1271320).
CVE-2026-58469: Metalink document containing a whitespace-only URL can cause a heap buffer underread (bsc#1271033).
CVE-2026-58470: server-controlled values can cause an integer overflow in parse_content_range() (bsc#1271034).
CVE-2026-58471: server-supplied filenames requiring character set conversion could lead to heap memory corruption (bsc#1271035).
CVE-2026-58472: crafted HTML attribute with a large number of characters can lead to a heap buffer overflow (bsc#1271036).

Affected Packages

wget

SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Basesystem 15 SP7SUSE Linux Enterprise Server 15 SP7SUSE Linux Enterprise Server for SAP Applications 15 SP7

Fixed in:

1.24.5-150700.3.3.1

References

ADVISORY

https://bugzilla.suse.com/1233773

ADVISORY

https://bugzilla.suse.com/1271033

ADVISORY

https://bugzilla.suse.com/1271034

ADVISORY

https://bugzilla.suse.com/1271035

ADVISORY