SUSE-SU-2026:3206-1

Details

Description of the patch:

This update for wget fixes the following issues:

CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery (bsc#1271320).
CVE-2026-58469: Metalink document containing a whitespace-only URL can cause a heap buffer underread (bsc#1271033).
CVE-2026-58470: server-controlled Content-Range header values can cause an integer overflow in parse_content_range() (bsc#1271034).
CVE-2026-58471: server-supplied filenames requiring character set conversion could lead to heap memory corruption (bsc#1271035).
CVE-2026-58472: crafted HTML attribute with a large number of characters requiring entity encoding can lead to a heap buffer overflow (bsc#1271036).
Fix metalink regression from CVE-2026-58469 fix (bsc#1272219).

Affected Packages

wget

SUSE Linux Enterprise High Performance Computing 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS

Fixed in:

1.20.3-150000.3.34.1

References

ADVISORY

https://bugzilla.suse.com/1271033

ADVISORY

https://bugzilla.suse.com/1271034

ADVISORY

https://bugzilla.suse.com/1271035

ADVISORY

https://bugzilla.suse.com/1271036

ADVISORY