Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20161103042540.GB10528@kcwu.csie.org>
Date: Thu, 3 Nov 2016 12:25:40 +0800
From: Kuang-che Wu <kcwu@...e.org>
To: oss-security@...ts.openwall.com
Subject: CVE request: w3m - multiple vulnerabilities

Following are security flaws that I reported to debian's w3m.
https://github.com/tats/w3m
(The original w3m project on sf.net https://sourceforge.net/projects/w3m/ is no
 longer maintained for several years. Debian's w3m is the only fork still
 maintained)

These issues are all fixed in 0.5.3-31 released at Oct 15, 2016.

Please assign CVEs if you think they are suitable for identifiers.

Serious issues
- https://github.com/tats/w3m/issues/8 stack smashed
  see analysis in https://github.com/tats/w3m/pull/19
- https://github.com/tats/w3m/issues/9 some buffer overflow
- https://github.com/tats/w3m/issues/12 heap write
- https://github.com/tats/w3m/issues/21 heap write
- https://github.com/tats/w3m/issues/25 heap corruption
  itself should be only OOM. But it was affected by
    https://github.com/ivmai/bdwgc/issues/135
  which become heap corruption
- https://github.com/tats/w3m/issues/26 heap write
- https://github.com/tats/w3m/issues/29 global-buffer-overflow write
  

Moderate issues
(the crash point looks not-explitable but I am not sure whether 
 they could be reused as exploit gadget)
- https://github.com/tats/w3m/issues/7 null deref
- https://github.com/tats/w3m/issues/10 stack overflow
- https://github.com/tats/w3m/issues/13 bcopy negative size
- https://github.com/tats/w3m/issues/14 array index out of bound read
- https://github.com/tats/w3m/issues/15 null deref
- https://github.com/tats/w3m/issues/16 use uninit value
- https://github.com/tats/w3m/issues/17 write to rodata
- https://github.com/tats/w3m/issues/18 null deref
- https://github.com/tats/w3m/issues/20 stack overflow
- https://github.com/tats/w3m/issues/22 near-null deref
- https://github.com/tats/w3m/issues/24 near-null deref
- https://github.com/tats/w3m/commit/d43527 potential heap buffer corruption
  I classify this as "moderate" because the allocator do preserve more space
  than required size due to bucketing. And w3m's allocator is boehmgc, it
  seems not easy replacible. So the heap won't be corrupted in practice.
- https://github.com/tats/w3m/issues/28 null deref


Not security issue, just DoS
- https://github.com/tats/w3m/issues/11 OOM


Regards,
kcwu

Download attachment "signature.asc" of type "application/pgp-signature" (802 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.