{"id":"CLSA-2026-1784210930","summary":"Fix CVE(s): CVE-2026-58469, CVE-2026-58471, CVE-2026-58472","details":"   * SECURITY UPDATE: heap buffer under-read in clean_metalink_string()\n     - debian/patches/CVE-2026-58469.patch: bound the backward whitespace\n       scan with end \u003e beg in src/metalink.c so an all-whitespace Metalink\n       URL cannot read before the start of the buffer\n     - CVE-2026-58469\n   * SECURITY UPDATE: heap buffer overflow in convert_fname()\n     - debian/patches/CVE-2026-58471.patch: correctly track used and\n       remaining space across the iconv E2BIG reallocation in src/url.c so\n       the output buffer is not overflowed\n     - CVE-2026-58471\n   * SECURITY UPDATE: integer and heap buffer overflow in html_quote_string()\n     - debian/patches/CVE-2026-58472.patch: size the quoted string using\n       overflow-checked accumulation (size_t with INT_ADD_WRAPV) in\n       src/convert.c and abort on overflow instead of under-allocating\n     - CVE-2026-58472","modified":"2026-10-26T09:31:47.204135080Z","published":"2026-07-16T14:09:17Z","upstream":["CVE-2026-58469","CVE-2026-58471","CVE-2026-58472"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1784210930.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58469"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58471"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58472"}],"affected":[{"package":{"name":"wget","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/wget?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.4-1ubuntu2.2+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784210930.json"}}],"schema_version":"1.9.0"}