PT-2010-4305 · Lynx · Lynx

Dan Rosenberg · Published 2010-08-20 · Updated 2017-08-17 · CVE-2010-2810

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Lynx versions 2.8.8dev.1 through 2.8.8dev.4

Description The issue is related to a heap-based buffer overflow in the convert to idna function, which can be triggered by a malformed URL containing a % (percent) character in the domain name. This can cause a denial of service, resulting in an application crash, or potentially allow the execution of arbitrary code.

Recommendations For versions 2.8.8dev.1 through 2.8.8dev.4, consider avoiding the use of URLs with % characters in the domain name until a fix is available. As a temporary workaround, restrict access to potentially malicious URLs to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2010-2810

Affected Products

Lynx

References · 7

• http://ubuntu.com/usn/USN-1642-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2810 · Security Note
• http://vupen.com/english/advisories/2010/2042 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/61007 · Note
• http://marc.info/?l=oss-security&m=128151768510564&w=2 · Note
• https://bugs.launchpad.net/ubuntu/+source/lynx-cur/+bug/613254 · Note
• http://marc.info/?l=oss-security&m=128152412221677&w=2 · Note