PT-2002-3153 · Debian · W3M-Img+6
Publicado
1970-01-01
·
Atualizado
2017-07-11
·
CVE-2002-1335
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
w3m version 0.3.2
w3m-img (affected versions not specified)
w3m-ssl (affected versions not specified)
w3mmee (affected versions not specified)
w3mmee-img (affected versions not specified)
w3mmee-ssl (affected versions not specified)
Description
The issue concerns multiple vulnerabilities in the w3m package of the Debian GNU/Linux operating system, which can lead to a breach of protected information. These vulnerabilities can be exploited remotely. A specific vulnerability in w3m 0.3.2 involves a cross-site scripting (XSS) issue where an HTML tag in a frame is not properly escaped, allowing remote attackers to insert arbitrary web script or HTML and access files or cookies.
Recommendations
For w3m version 0.3.2, consider updating to a newer version that addresses the XSS vulnerability.
For w3m-img, restrict access to sensitive information until a patch is available.
For w3m-ssl, avoid using the package for sensitive operations until a fix is provided.
For w3mmee, temporarily disable the use of the package to minimize the risk of exploitation.
For w3mmee-img, restrict access to the package until a patch is available.
For w3mmee-ssl, consider disabling the package until a fix is provided.
At the moment, there is no information about a newer version that contains a fix for this vulnerability in some of the affected packages.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Debian
W3M
W3M-Img
W3M-Ssl
W3Mmee
W3Mmee-Img
W3Mmee-Ssl