Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 556
Alerts This Week
Warning Icon 1 556

Ubuntu 23.10 USN-6580-1 Critical: w3m Arbitrary Code Execution

ubuntu
Calendar Grey January 15, 2024
Dist Ubuntu Esm H88
Ubuntu 23.10 USN-6580-1 addresses critical w3m security issue with arbitrary code execution potential.
w3m could be made to crash or run programs as your login if it opened a malicious website.

Summary

w3m could be made to crash or run programs as your login if it opened a malicious website.

Software Description:

- w3m: WWW browsable pager with excellent tables/frames support

Details:

It was discovered that w3m incorrectly handled certain HTML files.

An attacker could possibly use this issue to cause a crash or

execute arbitrary code.

Topics%20covered

Topics Covered

security advisory critical DoS Ubuntu arbitrary code w3m

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
  w3m                             0.5.3+git20230121-2ubuntu0.23.10.1

Ubuntu 23.04:
  w3m                             0.5.3+git20230121-2ubuntu0.23.04.1

Ubuntu 22.04 LTS:
  w3m                             0.5.3+git20210102-6ubuntu0.2

Ubuntu 20.04 LTS:
  w3m                             0.5.3-37ubuntu0.2

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
  w3m                             0.5.3-36ubuntu0.1+esm1

Ubuntu 14.04 LTS (Available with Ubuntu Pro):
  w3m                             0.5.3-15ubuntu0.2+esm2

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-6580-1

CVE-2023-4255

Severity
critical
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-6580-1

Topics%20covered

Topics Covered

security advisory critical DoS Ubuntu arbitrary code w3m

Package Information

https://launchpad.net/ubuntu/+source/w3m/0.5.3+git20230121-2ubuntu0.23.10.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.