Out-of-bounds read in w3m - CVE-2023-38252

Vulnerability identifier: #VU83258

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-38252

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to crash the application.

The vulnerability exists due to a boundary condition within the Strnew_size() function in Str.c. A remote attacker can create a specially crafted HTML file, trick the victim into opening it, trigger an out-of-bounds read error and crash the application.

w3m
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
Fedora
Basesystem Module
openSUSE Leap
w3m
w3m-debugsource
w3m-inline-image-debuginfo
w3m-inline-image
w3m-debuginfo

Install updates from vendor's website.

w3m - update to 0.5.3+git20230121-150000.3.6.1
w3m-debugsource - update to 0.5.3+git20230121-150000.3.6.1
w3m-inline-image-debuginfo - update to 0.5.3+git20230121-150000.3.6.1
w3m-inline-image - update to 0.5.3+git20230121-150000.3.6.1
w3m-debuginfo - update to 0.5.3+git20230121-150000.3.6.1
w3m - addressed in versions 0.5.3-63.git20230121.el7, 0.5.3-63.git20230121.el8, 0.5.3-63.git20230121.el9, 0.5.3-63.git20230121.fc38, 0.5.3-63.git20230121.fc39, 0.5.3-63.git20230121.fc40

• https://github.com/tats/w3m/issues/270
• https://access.redhat.com/security/cve/CVE-2023-38252
• https://bugzilla.redhat.com/show_bug.cgi?id=2222775

• Multiple vulnerabilities in w3m
• SUSE update for w3m
• Fedora 39 update for w3m
• Fedora 40 update for w3m
• Fedora 38 update for w3m
• Fedora EPEL 8 update for w3m
• Fedora EPEL 9 update for w3m
• Fedora EPEL 7 update for w3m