CVE-2010-2810 Heap-based buffer overflow in the convert_to_idna function in WWW/Library/Implementation/HTParse.c in Lynx 2.8.8dev.1 through 2.8.8dev.4 allows remote attackers to cause a denial of service (applicati...
MediumCVSS 6.8
EPSS 3.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Heap-based buffer overflow in the convert_to_idna function in WWW/Library/Implementation/HTParse.c in Lynx 2.8.8dev.1 through 2.8.8dev.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed URL containing a % (percent) character in the domain name.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lynx | = 2.8.8-dev.1 | No fix listed |
| lynx | = 2.8.8-dev.2 | No fix listed |
| lynx | = 2.8.8-dev.3 | No fix listed |
| lynx | = 2.8.8-dev.4 | No fix listed |
References
- [oss-security] 20100809 CVE request: Lynx mailing-list
- [oss-security] 20100809 Re: CVE request: Lynx mailing-list
- USN-1642-1 vendor-advisory
- ADV-2010-2042 vdb-entry vendor-advisory
- bugs.launchpad.net
- lynx-converttoidna-bo(61007) vdb-entry