Date: Thu, 3 Nov 2016 12:25:40 +0800 From: Kuang-che Wu <kcwu@...e.org> To: oss-security@...ts.openwall.com Subject: CVE request: w3m - multiple vulnerabilities Following are security flaws that I reported to debian's w3m. https://github.com/tats/w3m (The original w3m project on sf.net https://sourceforge.net/projects/w3m/ is no longer maintained for several years. Debian's w3m is the only fork still maintained) These issues are all fixed in 0.5.3-31 released at Oct 15, 2016. Please assign CVEs if you think they are suitable for identifiers. Serious issues - https://github.com/tats/w3m/issues/8 stack smashed see analysis in https://github.com/tats/w3m/pull/19 - https://github.com/tats/w3m/issues/9 some buffer overflow - https://github.com/tats/w3m/issues/12 heap write - https://github.com/tats/w3m/issues/21 heap write - https://github.com/tats/w3m/issues/25 heap corruption itself should be only OOM. But it was affected by https://github.com/ivmai/bdwgc/issues/135 which become heap corruption - https://github.com/tats/w3m/issues/26 heap write - https://github.com/tats/w3m/issues/29 global-buffer-overflow write Moderate issues (the crash point looks not-explitable but I am not sure whether they could be reused as exploit gadget) - https://github.com/tats/w3m/issues/7 null deref - https://github.com/tats/w3m/issues/10 stack overflow - https://github.com/tats/w3m/issues/13 bcopy negative size - https://github.com/tats/w3m/issues/14 array index out of bound read - https://github.com/tats/w3m/issues/15 null deref - https://github.com/tats/w3m/issues/16 use uninit value - https://github.com/tats/w3m/issues/17 write to rodata - https://github.com/tats/w3m/issues/18 null deref - https://github.com/tats/w3m/issues/20 stack overflow - https://github.com/tats/w3m/issues/22 near-null deref - https://github.com/tats/w3m/issues/24 near-null deref - https://github.com/tats/w3m/commit/d43527 potential heap buffer corruption I classify this as "moderate" because the allocator do preserve more space than required size due to bucketing. And w3m's allocator is boehmgc, it seems not easy replacible. So the heap won't be corrupted in practice. - https://github.com/tats/w3m/issues/28 null deref Not security issue, just DoS - https://github.com/tats/w3m/issues/11 OOM Regards, kcwu Download attachment "signature.asc" of type "application/pgp-signature" (802 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ