CVE-2016-9435 The HTMLtagproc1 function in file.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application via a crafted html file, related to <dd>...
MediumCVSS 6.5
EPSS 3.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The HTMLtagproc1 function in file.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application via a crafted html file, related to <dd> tags.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/w3m(Debian:12) | < 0.5.3-30 | 0.5.3-30 |
| debian/w3m(Debian:13) | < 0.5.3-30 | 0.5.3-30 |
| debian/w3m(Debian:14) | < 0.5.3-30 | 0.5.3-30 |
| openSUSE leap | = 42.2 | No fix listed |
| opensuse project leap | = 42.1 | No fix listed |
| tats w3m | <= 0.5.3\+git20160718 | No fix listed |
References
- Debian Security Tracker CVE-2016-9435 vendor-advisory
- openSUSE-SU-2016:3121 third-party-advisory vendor-advisory
- [oss-security] 20161118 Re: CVE request: w3m - multiple vulnerabilities mailing-list patch third-party-advisory
- 94407 third-party-advisory vdb-entry
- github.com issue-tracking patch third-party-advisory
- github.com issue-tracking patch third-party-advisory
- GLSA-201701-08 third-party-advisory vdb-entry vendor-advisory