PT-2022-24295 · W3M+5 · W3M+5

Han Zheng · Published 2022-08-15 · Updated 2025-11-04 · CVE-2022-38223

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions w3m version 0.5.3

Description The issue is an out-of-bounds write in the checkType function located in etc.c. It can be triggered by sending a crafted HTML file to the w3m binary, allowing an attacker to cause Denial of Service or possibly have unspecified other impact.

Recommendations For w3m version 0.5.3, consider disabling the checkType function as a temporary workaround until a patch is available. Restrict access to the etc.c module to minimize the risk of exploitation. Avoid using crafted HTML files with the w3m binary until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2025-12040

CVE-2022-38223

DLA-3541-1

MGASA-2023-0006

OPENSUSE-SU-2023_0065-1

OPENSUSE-SU-2024:12612-1

SUSE-SU-2023:0065-1

SUSE-SU-2023:0066-1

SUSE-SU-2023_0065-1

SUSE-SU-2023_0066-1

USN-5796-1

USN-5796-2

Affected Products

Alt Linux

Astra Linux

Linuxmint

Suse

Ubuntu

W3M

References · 40

• 🔥 https://github.com/tats/w3m/issues/242 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2022-38223 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12612-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-38223 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MKFZQUK7FPWWJQYICDZZ4YWIPUPQ2D3R · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3541-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2022-38223 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NRRZMTLG3YT6U3PSGJOAMLDNLRF2EUOP · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0006.html · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/TODROGVCWZ435HQIZE6ARQC5LPQLIA5C · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-38223 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MKESIFZMWIFMI6DRGMUYOTVKBOSEKDXZ · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AULOBQJLXE2KCT5UVQMKGEFL4GFIAOED · Vendor Advisory
• https://osv.dev/vulnerability/USN-5796-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:0065-1 · Vendor Advisory