GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity encoding. A server-supplied HTML attribute causes a signed integer counter to overflow during output size accumulation, resulting in an undersized heap allocation and subsequent heap buffer overflow during the copy phase.
1.21.2-2ubuntu1.31.21.4-1ubuntu4.31.24.5-2ubuntu11.25.0-2ubuntu11.25.0-2ubuntu21.25.0-2ubuntu31.25.0-2ubuntu4.21.15-1ubuntu1.14.04.5+esm21.17.1-1ubuntu1.5+esm31.19.4-1ubuntu2.2+esm31.20.3-1ubuntu2.1+esm2Exploitability
AV:NAC:HAT:NPR:NUI:PVulnerable System
VC:NVI:LVA:HSubsequent System
SC:NSI:NSA:NCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N