Get Gentoo!
gentoo.org sites
gentoo.org Wiki Bugs Forums Packages
Planet Archives Sources
Infra Status

Gentoo Archives: gentoo-announce

From: Thomas Deutschmann <whissi@g.o>
To: gentoo-announce@l.g.o
Subject: [gentoo-announce] [ GLSA 201701-08 ] w3m: Multiple vulnerabilities
Date: Sun, 01 Jan 2017 16:19:26
Message-Id: ac55a3b8-90e0-38b6-fe7b-b15d61c34251@gentoo.org
1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2 Gentoo Linux Security Advisory GLSA 201701-08
3 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4 https://security.gentoo.org/
5 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7 Severity: Normal
8 Title: w3m: Multiple vulnerabilities
9 Date: January 01, 2017
10 Bugs: #579312, #600176
11 ID: 201701-08
12
13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15 Synopsis
16 ========
17
18 Multiple vulnerabilities have been found in w3m, the worst of which
19 could lead to the execution of arbitrary code.
20
21 Background
22 ==========
23
24 w3m is a text based WWW browser.
25
26 Affected packages
27 =================
28
29 -------------------------------------------------------------------
30 Package / Vulnerable / Unaffected
31 -------------------------------------------------------------------
32 1 www-client/w3m < 0.5.3-r9 >= 0.5.3-r9
33
34 Description
35 ===========
36
37 Multiple vulnerabilities have been discovered in w3m. Please review the
38 CVE identifiers referenced below for details.
39
40 Impact
41 ======
42
43 A remote attacker could execute arbitrary code with the privileges of
44 the process or cause a Denial of Service condition via a maliciously
45 crafted HTML file.
46
47 Workaround
48 ==========
49
50 There is no known workaround at this time.
51
52 Resolution
53 ==========
54
55 All w3m users should upgrade to the latest version:
56
57 # emerge --sync
58 # emerge --ask --oneshot --verbose ">=www-client/w3m-0.5.3-r9"
59
60 References
61 ==========
62
63 [ 1 ] CVE-2016-9422
64 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9422
65 [ 2 ] CVE-2016-9423
66 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9423
67 [ 3 ] CVE-2016-9424
68 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9424
69 [ 4 ] CVE-2016-9425
70 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9425
71 [ 5 ] CVE-2016-9426
72 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9426
73 [ 6 ] CVE-2016-9428
74 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9428
75 [ 7 ] CVE-2016-9429
76 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9429
77 [ 8 ] CVE-2016-9430
78 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9430
79 [ 9 ] CVE-2016-9431
80 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9431
81 [ 10 ] CVE-2016-9432
82 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9432
83 [ 11 ] CVE-2016-9433
84 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9433
85 [ 12 ] CVE-2016-9434
86 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9434
87 [ 13 ] CVE-2016-9435
88 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9435
89 [ 14 ] CVE-2016-9436
90 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9436
91 [ 15 ] CVE-2016-9437
92 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9437
93 [ 16 ] CVE-2016-9438
94 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9438
95 [ 17 ] CVE-2016-9439
96 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9439
97 [ 18 ] CVE-2016-9440
98 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9440
99 [ 19 ] CVE-2016-9441
100 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9441
101 [ 20 ] CVE-2016-9442
102 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9442
103 [ 21 ] CVE-2016-9443
104 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9443
105
106 Availability
107 ============
108
109 This GLSA and any updates to it are available for viewing at
110 the Gentoo Security Website:
111
112 https://security.gentoo.org/glsa/201701-08
113
114 Concerns?
115 =========
116
117 Security is a primary focus of Gentoo Linux and ensuring the
118 confidentiality and security of our users' machines is of utmost
119 importance to us. Any security concerns should be addressed to
120 security@g.o or alternatively, you may file a bug at
121 https://bugs.gentoo.org.
122
123 License
124 =======
125
126 Copyright 2017 Gentoo Foundation, Inc; referenced text
127 belongs to its owner(s).
128
129 The contents of this document are licensed under the
130 Creative Commons - Attribution / Share Alike license.
131
132 http://creativecommons.org/licenses/by-sa/2.5

Attachments

File name MIME type
signature.asc application/pgp-signature
Report Message
Find on MARC Find on Google Groups