[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 3 Nov 2016 12:25:40 +0800
From: Kuang-che Wu <kcwu@...e.org>
To: oss-security@...ts.openwall.com
Subject: CVE request: w3m - multiple vulnerabilities
Following are security flaws that I reported to debian's w3m.
https://github.com/tats/w3m
(The original w3m project on sf.net https://sourceforge.net/projects/w3m/ is no
longer maintained for several years. Debian's w3m is the only fork still
maintained)
These issues are all fixed in 0.5.3-31 released at Oct 15, 2016.
Please assign CVEs if you think they are suitable for identifiers.
Serious issues
- https://github.com/tats/w3m/issues/8 stack smashed
see analysis in https://github.com/tats/w3m/pull/19
- https://github.com/tats/w3m/issues/9 some buffer overflow
- https://github.com/tats/w3m/issues/12 heap write
- https://github.com/tats/w3m/issues/21 heap write
- https://github.com/tats/w3m/issues/25 heap corruption
itself should be only OOM. But it was affected by
https://github.com/ivmai/bdwgc/issues/135
which become heap corruption
- https://github.com/tats/w3m/issues/26 heap write
- https://github.com/tats/w3m/issues/29 global-buffer-overflow write
Moderate issues
(the crash point looks not-explitable but I am not sure whether
they could be reused as exploit gadget)
- https://github.com/tats/w3m/issues/7 null deref
- https://github.com/tats/w3m/issues/10 stack overflow
- https://github.com/tats/w3m/issues/13 bcopy negative size
- https://github.com/tats/w3m/issues/14 array index out of bound read
- https://github.com/tats/w3m/issues/15 null deref
- https://github.com/tats/w3m/issues/16 use uninit value
- https://github.com/tats/w3m/issues/17 write to rodata
- https://github.com/tats/w3m/issues/18 null deref
- https://github.com/tats/w3m/issues/20 stack overflow
- https://github.com/tats/w3m/issues/22 near-null deref
- https://github.com/tats/w3m/issues/24 near-null deref
- https://github.com/tats/w3m/commit/d43527 potential heap buffer corruption
I classify this as "moderate" because the allocator do preserve more space
than required size due to bucketing. And w3m's allocator is boehmgc, it
seems not easy replacible. So the heap won't be corrupted in practice.
- https://github.com/tats/w3m/issues/28 null deref
Not security issue, just DoS
- https://github.com/tats/w3m/issues/11 OOM
Regards,
kcwu
Download attachment "signature.asc" of type "application/pgp-signature" (802 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
