PT-2004-3764 · Lynx · Lynx

Michal Zalewski

·

Publicado

1970-01-01

·

Atualizado

2018-10-19

·

CVE-2004-1617

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Lynx, lynx-ssl, and lynx-cur versions prior to 2.8.6dev.8
Description The issue allows remote attackers to cause a denial of service, potentially leading to disruption of confidentiality, integrity, and availability of protected information. This can be triggered by a web page or HTML email containing invalid HTML, including a TEXTAREA tag with a large COLS value. The exploitation of this issue can be performed remotely.
Recommendations For versions prior to 2.8.6dev.8, update to version 2.8.6dev.8 or later to resolve the issue. As a temporary workaround, consider restricting access to web pages or HTML emails that may contain invalid HTML until a patch is available.

Exploit

Correção

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2015-04083
BDU:2015-04084
CVE-2004-1617
DSA-1076-1
DSA-1077-1

Produtos afetados

Lynx