PT-2017-10138 · W3M+3 · W3M+3

Kcwu · Published 2016-12-07 · Updated 2024-06-15 · CVE-2016-9435

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions w3m versions prior to 0.5.3+git20161009

Description The issue is related to the HTML tag processing in the w3m application. Specifically, the HTMLtagproc1 function in the file.c file does not properly initialize values. This can be exploited by remote attackers to crash the application via a crafted HTML file, particularly those containing <dd> tags.

Recommendations For versions prior to 0.5.3+git20161009, update to version 0.5.3+git20161009 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2020-3081

ALT-PU-2020-3099

CVE-2016-9435

MGASA-2018-0024

OPENSUSE-SU-2024:10235-1

SUSE-SU-2016:3046-1

SUSE-SU-2016:3053-1

USN-3214-1

Affected Products

Alt Linux

Suse

Ubuntu

W3M

References · 116

• https://github.com/tats/w3m/commit/33509cc81ec5f2ba44eb6fd98bd5c1b5873e46bd · Patch
• https://github.com/tats/w3m/issues/16 · Patch
• https://ubuntu.com/security/CVE-2016-9628 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9433 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-9435 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9443 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9428 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-9435 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9424 · Vendor Advisory
• https://security.gentoo.org/glsa/201701-08 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9440 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9625 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2016-12/msg00084.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0024.html · Security Note
• https://ubuntu.com/security/notices/USN-3214-1 · Vendor Advisory