oss-sec mailing list archives
CVE request: w3m - multiple vulnerabilities
From: Kuang-che Wu <kcwu () csie org>
Date: Thu, 3 Nov 2016 12:25:40 +0800
Following are security flaws that I reported to debian's w3m. https://github.com/tats/w3m (The original w3m project on sf.net https://sourceforge.net/projects/w3m/ is no longer maintained for several years. Debian's w3m is the only fork still maintained) These issues are all fixed in 0.5.3-31 released at Oct 15, 2016. Please assign CVEs if you think they are suitable for identifiers. Serious issues - https://github.com/tats/w3m/issues/8 stack smashed see analysis in https://github.com/tats/w3m/pull/19 - https://github.com/tats/w3m/issues/9 some buffer overflow - https://github.com/tats/w3m/issues/12 heap write - https://github.com/tats/w3m/issues/21 heap write - https://github.com/tats/w3m/issues/25 heap corruption itself should be only OOM. But it was affected by https://github.com/ivmai/bdwgc/issues/135 which become heap corruption - https://github.com/tats/w3m/issues/26 heap write - https://github.com/tats/w3m/issues/29 global-buffer-overflow write Moderate issues (the crash point looks not-explitable but I am not sure whether they could be reused as exploit gadget) - https://github.com/tats/w3m/issues/7 null deref - https://github.com/tats/w3m/issues/10 stack overflow - https://github.com/tats/w3m/issues/13 bcopy negative size - https://github.com/tats/w3m/issues/14 array index out of bound read - https://github.com/tats/w3m/issues/15 null deref - https://github.com/tats/w3m/issues/16 use uninit value - https://github.com/tats/w3m/issues/17 write to rodata - https://github.com/tats/w3m/issues/18 null deref - https://github.com/tats/w3m/issues/20 stack overflow - https://github.com/tats/w3m/issues/22 near-null deref - https://github.com/tats/w3m/issues/24 near-null deref - https://github.com/tats/w3m/commit/d43527 potential heap buffer corruption I classify this as "moderate" because the allocator do preserve more space than required size due to bucketing. And w3m's allocator is boehmgc, it seems not easy replacible. So the heap won't be corrupted in practice. - https://github.com/tats/w3m/issues/28 null deref Not security issue, just DoS - https://github.com/tats/w3m/issues/11 OOM Regards, kcwu
Attachment:
signature.asc
Description:
Current thread:
- CVE request: w3m - multiple vulnerabilities Kuang-che Wu (Nov 03)
- Re: CVE request: w3m - multiple vulnerabilities cve-assign (Nov 18)
- <Possible follow-ups>
- CVE request: w3m - multiple vulnerabilities Kuang-che Wu (Nov 21)
- Re: CVE request: w3m - multiple vulnerabilities cve-assign (Nov 23)
- Re: Re: CVE request: w3m - multiple vulnerabilities Kuang-che Wu (Nov 25)
- Re: Re: CVE request: w3m - multiple vulnerabilities Kuang-che Wu (Dec 14)
- Re: CVE request: w3m - multiple vulnerabilities cve-assign (Nov 23)