Debian: 'w3m' buffer overflow
Debian: 'w3m' buffer overflow
In SNS Advisory No. 32 a buffer overflow vulnerability has been reported in the routine which parses MIME headers that are returned from web servers. A malicious web server administrator could exploit this and let the client web browser execute arbitrary code.
-------------------------------------------------------------------------- Debian Security Advisory DSA 081-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Martin Schulze October 18th, 2001 -------------------------------------------------------------------------- Packages : w3m, w3m-ssl Vulnerability : Buffer Overflow Problem-Type : remote code execution Debian-specific: no In SNS Advisory No. 32 a buffer overflow vulnerability has been reported in the routine which parses MIME headers that are returned from web servers. A malicious web server administrator could exploit this and let the client web browser execute arbitrary code. W3m handles MIME headers included in the request/response message of HTTP communication like any other we bbrowser. A buffer overflow will be occur when w3m receives a MIME encoded header with base64 format. This problem has been fixed by the maintainer in version 0.1.10+0.1.11pre+kokb23-4 of w3m and w3m-ssl (for the SSL-enabled version), both for Debian GNU/Linux 2.2. We recommend that you upgrade your w3m packages immediately. wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 2.2 alias potato ------------------------------------ Source archives: https://security.debian.org/dists/stable/updates/main/source/w3m_0.1.10+0.1.11pre+kokb23-4.diff.gz MD5 checksum: 94e868f1fa21be50a56d40007a21acc6 https://security.debian.org/dists/stable/updates/main/source/w3m_0.1.10+0.1.11pre+kokb23.orig.tar.gz MD5 checksum: 8f4503bbc966761d806d770fe1632450 https://security.debian.org/dists/stable/updates/main/source/w3m_0.1.10+0.1.11pre+kokb23-4.dsc MD5 checksum: 46bd8e55a198036391b57a847486c303 https://security.debian.org/dists/stable/updates/main/source/w3m-ssl_0.1.10+0.1.11pre+kokb23-4.dsc MD5 checksum: 6bc881ce595e5f723bcbd61dc6520523 https://security.debian.org/dists/stable/updates/main/source/w3m-ssl_0.1.10+0.1.11pre+kokb23-4.tar.gz MD5 checksum: c857fd94c8e76f451ddfc3e59ce2d678 Alpha architecture: https://security.debian.org/dists/stable/updates/main/binary-alpha/w3m_0.1.10+0.1.11pre+kokb23-4_alpha.deb MD5 checksum: 2da17834f750361ef11f956aea86bcdc https://security.debian.org/dists/stable/updates/main/binary-alpha/w3m-ssl_0.1.10+0.1.11pre+kokb23-4_alpha.deb MD5 checksum: b5b17b0ab958e1ce5ae82998c8c52a21 ARM architecture: https://security.debian.org/dists/stable/updates/main/binary-arm/w3m_0.1.10+0.1.11pre+kokb23-4_arm.deb MD5 checksum: da67534b0182355a57618231addd92ae https://security.debian.org/dists/stable/updates/main/binary-arm/w3m-ssl_0.1.10+0.1.11pre+kokb23-4_arm.deb MD5 checksum: cd5a22df1fbca97ec3ce9d7a6760ab41 Intel ia32 architecture: https://security.debian.org/dists/stable/updates/main/binary-i386/w3m_0.1.10+0.1.11pre+kokb23-4_i386.deb MD5 checksum: 7b811019f0f246338cbf438952358b54 https://security.debian.org/dists/stable/updates/main/binary-i386/w3m-ssl_0.1.10+0.1.11pre+kokb23-4_i386.deb MD5 checksum: 07c9aa2738a22e4984c290657c71b79d PowerPC architecture: https://security.debian.org/dists/stable/updates/main/binary-powerpc/w3m_0.1.10+0.1.11pre+kokb23-4_powerpc.deb MD5 checksum: 64211980c4101e493aa2c0f906c6be9c Sun Sparc architecture: https://security.debian.org/dists/stable/updates/main/binary-sparc/w3m_0.1.10+0.1.11pre+kokb23-4_sparc.deb MD5 checksum: 4016ba11b084cd94e6023b47e7270f74 https://security.debian.org/dists/stable/updates/main/binary-sparc/w3m-ssl_0.1.10+0.1.11pre+kokb23-4_sparc.deb MD5 checksum: 4a50edab63b9fe3c6c40638902018ebb w3m-ssl is not available for stable/powerpc and neither w3m nor w3m-ssl are available for m68k. These files will be moved into the stable distribution on its next revision. --------------------------------------------------------------------------------- For apt-get: deb https://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. Package info: `apt-cache show' and https://packages.debian.org/