PT-2017-10138 · W3M+3 · W3M+3

Kcwu · Publicado 2016-12-07 · Atualizado 2024-06-15 · CVE-2016-9435

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions w3m versions prior to 0.5.3+git20161009

Description The issue is related to the HTML tag processing in the w3m application. Specifically, the HTMLtagproc1 function in the file.c file does not properly initialize values. This can be exploited by remote attackers to crash the application via a crafted HTML file, particularly those containing <dd> tags.

Recommendations For versions prior to 0.5.3+git20161009, update to version 0.5.3+git20161009 or later to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2020-3081

ALT-PU-2020-3099

CVE-2016-9435

MGASA-2018-0024

OPENSUSE-SU-2024:10235-1

SUSE-SU-2016:3046-1

SUSE-SU-2016:3053-1

USN-3214-1

Produtos afetados

Alt Linux

Suse

Ubuntu

W3M

Referências · 116

• https://github.com/tats/w3m/commit/33509cc81ec5f2ba44eb6fd98bd5c1b5873e46bd · Correção
• https://github.com/tats/w3m/issues/16 · Correção
• https://ubuntu.com/security/CVE-2016-9628 · Aviso do Fabricante
• https://bugzilla.suse.com/1012026 · Nota
• https://ubuntu.com/security/CVE-2016-9433 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-9439 · Nota
• https://bugzilla.suse.com/1011285 · Nota
• https://suse.com/security/cve/CVE-2012-4929 · Nota
• https://security-tracker.debian.org/tracker/CVE-2016-9435 · Aviso do Fabricante
• https://lists.opensuse.org/opensuse-updates/2016-12/msg00084.html · Nota
• https://bugzilla.suse.com/1011283 · Nota
• https://ubuntu.com/security/CVE-2016-9443 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-9428 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-9443 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-9435 · Aviso do Fabricante