Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

Ubuntu: USN-2020-1234-1 High Severity PostgreSQL Security Flaw

red hat
Calendar Grey October 27, 2008
Dist Redhat Esm H88
Critical: Patch released for lynx on CentOS resolving vulnerability issues and boosting user safety.
An updated lynx package that corrects two security issues is now available for Red Hat Enterprise Linux 2.1, 3, 4, and 5. This update has been rated as having important security ...

Solution

Before applying this update, make sure that all previously-released errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at

Summary

Lynx is a text-based Web browser.
An arbitrary command execution flaw was found in the Lynx "lynxcgi:" URI handler. An attacker could create a web page redirecting to a malicious URL that could execute arbitrary code as the user running Lynx in the non-default "Advanced" user mode. (CVE-2008-4690)
Note: In these updated lynx packages, Lynx will always prompt users before loading a "lynxcgi:" URI. Additionally, the default lynx.cfg configuration file now marks all "lynxcgi:" URIs as untrusted by default.
A flaw was found in a way Lynx handled ".mailcap" and ".mime.types" configuration files. Files in the browser's current working directory were opened before those in the user's home directory. A local attacker, able to convince a user to run Lynx in a directory under their control, could possibly execute arbitrary commands as the user running Lynx. (CVE-2006-7234)
All users of Lynx are advised to upgrade to this updated package, which contains backported patches correcting these issues.

Topics%20covered

Topics Covered

security advisory security update Red Hat command execution lynx important issue attack vector

References

https://www.cve.org/CVERecord?id=CVE-2008-4690 https://www.cve.org/CVERecord?id=CVE-2006-7234 https://access.redhat.com/security/updates/classification#important

Package List

Red Hat Enterprise Linux AS (Advanced Server) version 2.1 :
Source:
i386: lynx-2.8.4-18.1.3.i386.rpm
ia64: lynx-2.8.4-18.1.3.ia64.rpm
Red Hat Linux Advanced Workstation 2.1:
Source:
ia64: lynx-2.8.4-18.1.3.ia64.rpm
Red Hat Enterprise Linux ES version 2.1:
Source:
i386: lynx-2.8.4-18.1.3.i386.rpm
Red Hat Enterprise Linux WS version 2.1:
Source:
i386: lynx-2.8.4-18.1.3.i386.rpm
Red Hat Enterprise Linux AS version 3:
Source:
i386: lynx-2.8.5-11.3.i386.rpm lynx-debuginfo-2.8.5-11.3.i386.rpm
ia64: lynx-2.8.5-11.3.ia64.rpm lynx-debuginfo-2.8.5-11.3.ia64.rpm
ppc: lynx-2.8.5-11.3.ppc.rpm lynx-debuginfo-2.8.5-11.3.ppc.rpm
s390: lynx-2.8.5-11.3.s390.rpm lynx-debuginfo-2.8.5-11.3.s390.rpm
s390x: lynx-2.8.5-11.3.s390x.rpm lynx-debuginfo-2.8.5-11.3.s390x.rpm
x86_64: lynx-2.8.5-11.3.x86_64.rpm lynx-debuginfo-2.8.5-11.3.x86_64.rpm
Red Hat Desktop version 3:
Source:
i386: lynx-2.8.5-11.3.i386.rpm lynx-debuginfo-2.8.5-11.3.i386.rpm
x86_64: lynx-2.8.5-11.3.x86_64.rpm lynx-debuginfo-2.8.5-11.3.x86_64.rpm
Red Hat Enterprise Linux ES version 3:
Source:
i386: lynx-2.8.5-11.3.i386.rpm lynx-debuginfo-2.8.5-11.3.i386.rpm
ia64: lynx-2.8.5-11.3.ia64.rpm lynx-debuginfo-2.8.5-11.3.ia64.rpm
x86_64:

Read the Full Advisory


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2008:0965-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2008:0965.html
Issue date: 2008-10-27

Topic

An updated lynx package that corrects two security issues is now available for Red Hat Enterprise Linux 2.1, 3, 4, and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Topics%20covered

Topics Covered

security advisory security update Red Hat command execution lynx important issue attack vector

Relevant Releases Architectures

Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64

Red Hat Linux Advanced Workstation 2.1 - ia64

Red Hat Enterprise Linux ES version 2.1 - i386

Red Hat Enterprise Linux WS version 2.1 - i386

Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64

Red Hat Desktop version 3 - i386, x86_64

Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64

Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64

Red Hat Enterprise Linux Desktop version 4 - i386, x86_64

Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64

Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64

Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

Bugs Fixed

214205 - CVE-2006-7234 lynx: .mailcap and .mime.types files read from CWD

468184 - CVE-2008-4690 lynx: remote arbitrary command execution via a crafted lynxcgi: URL

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here