Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 3 Nov 2016 12:25:40 +0800
From: Kuang-che Wu <>
Subject: CVE request: w3m - multiple vulnerabilities

Following are security flaws that I reported to debian's w3m.
(The original w3m project on is no
 longer maintained for several years. Debian's w3m is the only fork still

These issues are all fixed in 0.5.3-31 released at Oct 15, 2016.

Please assign CVEs if you think they are suitable for identifiers.

Serious issues
- stack smashed
  see analysis in
- some buffer overflow
- heap write
- heap write
- heap corruption
  itself should be only OOM. But it was affected by
  which become heap corruption
- heap write
- global-buffer-overflow write

Moderate issues
(the crash point looks not-explitable but I am not sure whether 
 they could be reused as exploit gadget)
- null deref
- stack overflow
- bcopy negative size
- array index out of bound read
- null deref
- use uninit value
- write to rodata
- null deref
- stack overflow
- near-null deref
- near-null deref
- potential heap buffer corruption
  I classify this as "moderate" because the allocator do preserve more space
  than required size due to bucketing. And w3m's allocator is boehmgc, it
  seems not easy replacible. So the heap won't be corrupted in practice.
- null deref

Not security issue, just DoS


Download attachment "signature.asc" of type "application/pgp-signature" (802 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.