Vulnerability Name:

CVE-2016-9423 (CCN-119957)

Assigned:2016-11-18
Published:2016-11-18
Updated:2017-07-01
Summary:An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. Heap-based buffer overflow in w3m allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML page.
CVSS v3 Severity:8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
7.7 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
7.6 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H)
6.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): High
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
8.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Complete
Vulnerability Type:CWE-119
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2016-9423

Source: CCN
Type: oss-sec Mailing List, Fri, 18 Nov 2016 03:13:48 -0500
Re: CVE request: w3m - multiple vulnerabilities

Source: MLIST
Type: Mailing List, Third Party Advisory
[oss-security] 20161118 Re: CVE request: w3m - multiple vulnerabilities

Source: BID
Type: UNKNOWN
94407

Source: CCN
Type: BID-94407
w3m Multiple Security Vulnerabilities

Source: XF
Type: UNKNOWN
tats-w3m-cve20169423-bo(119957)

Source: CCN
Type: Tatsuya Kinoshita w3m for - GIT Repository
Debian's w3m: WWW browsable pager

Source: CONFIRM
Type: Issue Tracking, Patch
https://github.com/tats/w3m/blob/master/ChangeLog

Source: CONFIRM
Type: Issue Tracking, Patch
https://github.com/tats/w3m/issues/9

Source: GENTOO
Type: UNKNOWN
GLSA-201701-08

Vulnerable Configuration:Configuration 1:
  • cpe:/a:w3m_project:w3m:*:*:*:*:*:*:*:* (Version <= 0.5.3-30)

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20169423
    V
    		CVE-2016-9423
    2022-05-20
    oval:org.opensuse.security:def:33118
    P
    		Security update for apache2 (Important)
    2022-01-12
    oval:org.opensuse.security:def:30147
    P
    		Security update for MozillaFirefox (Important)
    2021-11-17
    oval:org.opensuse.security:def:30136
    P
    		Security update for xen (Moderate)
    2021-10-07
    oval:org.opensuse.security:def:30135
    P
    		Security update for apache2 (Important)
    2021-10-06
    oval:org.opensuse.security:def:31274
    P
    		Security update for the Linux Kernel (Live Patch 38 for SLE 12 SP3) (Important)
    2021-09-23
    oval:org.opensuse.security:def:31683
    P
    		Security update for ghostscript (Critical)
    2021-09-21
    oval:org.opensuse.security:def:34532
    P
    		Security update for openssl-1_0_0 (Low)
    2021-09-09
    oval:org.opensuse.security:def:32983
    P
    		Security update for cpio (Important)
    2021-08-23
    oval:org.opensuse.security:def:31661
    P
    		Security update for webkit2gtk3 (Important)
    2021-08-03
    oval:org.opensuse.security:def:31217
    P
    		Security update for arpwatch (Important)
    2021-06-28
    oval:org.opensuse.security:def:30221
    P
    		Security update for arpwatch (Important)
    2021-06-28
    oval:org.opensuse.security:def:34475
    P
    		Security update for libgcrypt (Important)
    2021-06-24
    oval:org.opensuse.security:def:36456
    P
    		libjasper-devel-1.900.1-134.17.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:36414
    P
    		glibc-html-2.11.3-17.84.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:33660
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:31622
    P
    		Security update for graphviz (Critical)
    2021-05-19
    oval:org.opensuse.security:def:35250
    P
    		Security update for the Linux Kernel (Important)
    2021-05-13
    oval:org.opensuse.security:def:32904
    P
    		Security update for MozillaFirefox (Important)
    2021-04-27
    oval:org.opensuse.security:def:34406
    P
    		Security update for the Linux Kernel (Important)
    2021-04-13
    oval:org.opensuse.security:def:32893
    P
    		Security update for wpa_supplicant (Moderate)
    2021-04-09
    oval:org.opensuse.security:def:32892
    P
    		Security update for fwupdate (Important)
    2021-04-08
    oval:org.opensuse.security:def:28963
    P
    		Security update for openssl (Moderate)
    2021-03-24
    oval:org.opensuse.security:def:31361
    P
    		Security update for the Linux Kernel (Live Patch 35 for SLE 12 SP3) (Important)
    2021-03-17
    oval:org.opensuse.security:def:29475
    P
    		Security update for java-1_8_0-ibm (Important)
    2021-02-26
    oval:org.opensuse.security:def:31727
    P
    		Security update for wpa_supplicant (Important)
    2021-02-15
    oval:org.opensuse.security:def:34622
    P
    		Security update for python36 (Important)
    2021-02-10
    oval:org.opensuse.security:def:33728
    P
    		Security update for python3 (Important)
    2021-02-08
    oval:org.opensuse.security:def:33684
    P
    		Security update for sudo (Important)
    2021-01-26
    oval:org.opensuse.security:def:31624
    P
    		Security update for dnsmasq (Important)
    2021-01-19
    oval:org.opensuse.security:def:33621
    P
    		Security update for openssl-1_0_0 (Important)
    2020-12-09
    oval:org.opensuse.security:def:35616
    P
    		mutt-1.5.17-42.33.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35732
    P
    		kvm-0.15.1-0.17.3 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35635
    P
    		quagga-0.99.15-0.1.55 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35557
    P
    		gnome-screensaver-2.28.3-0.4.30 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35704
    P
    		g3utils-1.1.36-26.31 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35665
    P
    		acpid-1.0.6-91.16.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35776
    P
    		libxslt-1.1.24-19.15 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35676
    P
    		cifs-utils-5.1-0.4.9 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:34157
    P
    		Security update for openssh-openssl1 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:35307
    P
    		Security update for lxc
    2020-12-01
    oval:org.opensuse.security:def:30904
    P
    		Security update for foomatic-filters (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30907
    P
    		Security update for freeradius-server (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29617
    P
    		Security update for bind (Important)
    2020-12-01
    oval:org.opensuse.security:def:30993
    P
    		Security update for jasper
    2020-12-01
    oval:org.opensuse.security:def:34781
    P
    		Security update for MozillaFirefox, mozilla-nspr, mozilla-nss (Important)
    2020-12-01
    oval:org.opensuse.security:def:30317
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33358
    P
    		Security update for openssl1 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28883
    P
    		Security update for bind (Important)
    2020-12-01
    oval:org.opensuse.security:def:34927
    P
    		Security update for expat (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30442
    P
    		Security update for zsh (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29094
    P
    		Recommended update for ghostscript-library (Important)
    2020-12-01
    oval:org.opensuse.security:def:31573
    P
    		Security update for strongswan (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34929
    P
    		Security update for facter (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30741
    P
    		Security update for amanda (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34146
    P
    		Security update for opensc (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29322
    P
    		Security update for compat-openssl097g
    2020-12-01
    oval:org.opensuse.security:def:30884
    P
    		Security update for MozillaFirefox
    2020-12-01
    oval:org.opensuse.security:def:34377
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29578
    P
    		Security update for apache2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32404
    P
    		Security update for w3m (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31586
    P
    		Security update for tcpdump (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30919
    P
    		Security update for gd (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29679
    P
    		Security update for e2fsprogs (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33270
    P
    		taglib on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28882
    P
    		Security update for bind (Important)
    2020-12-01
    oval:org.opensuse.security:def:34888
    P
    		Security update for curl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30353
    P
    		Security update for w3m
    2020-12-01
    oval:org.opensuse.security:def:33572
    P
    		Security update for LibVNCServer (Critical)
    2020-12-01
    oval:org.opensuse.security:def:31517
    P
    		Security update for quagga (Important)
    2020-12-01
    oval:org.opensuse.security:def:34997
    P
    		Security update for glibc (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34918
    P
    		Security update for emacs (Important)
    2020-12-01
    oval:org.opensuse.security:def:30586
    P
    		Security update for openssh (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34145
    P
    		Security update for openldap2 (Important)
    2020-12-01
    oval:org.opensuse.security:def:29237
    P
    		Security update for samba (Important)
    2020-12-01
    oval:org.opensuse.security:def:35149
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:30845
    P
    		Security update for dbus-1
    2020-12-01
    oval:org.opensuse.security:def:34241
    P
    		Security update for poppler (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29529
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:32365
    P
    		Security update for supportutils (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:35397
    P
    		Security update for openssh (Important)
    2020-12-01
    oval:org.opensuse.security:def:30948
    P
    		Recommended update for glibc (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30908
    P
    		Security update for freetype2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29635
    P
    		Security update for clamav (Important)
    2020-12-01
    oval:org.opensuse.security:def:33213
    P
    		nfs-client on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31125
    P
    		Security update for kvm (Important)
    2020-12-01
    oval:org.opensuse.security:def:34839
    P
    		Security update for bind (Critical)
    2020-12-01
    oval:org.opensuse.security:def:30354
    P
    		Security update for w3m (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33515
    P
    		Security update for PostgreSQL
    2020-12-01
    oval:org.opensuse.security:def:28894
    P
    		Security update for MozillaFirefox, mozilla-nspr (Important)
    2020-12-01
    oval:org.opensuse.security:def:34953
    P
    		Security update for MozillaFirefox, mozilla-nss (Important)
    2020-12-01
    oval:org.opensuse.security:def:34917
    P
    		Security update for emacs
    2020-12-01
    oval:org.opensuse.security:def:30499
    P
    		Security update for Mozilla Firefox
    2020-12-01
    oval:org.opensuse.security:def:29180
    P
    		Security update for microcode_ctl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:35013
    P
    		Security update for gpg2 (Important)
    2020-12-01
    oval:org.opensuse.security:def:30796
    P
    		Security update for bind (Important)
    2020-12-01
    oval:org.opensuse.security:def:34366
    P
    		Security update for tcpdump (Moderate)
    2020-12-01
    oval:com.ubuntu.xenial:def:201694230000000
    V
    		CVE-2016-9423 on Ubuntu 16.04 LTS (xenial) - low.
    2016-12-12
    oval:com.ubuntu.precise:def:20169423000
    V
    		CVE-2016-9423 on Ubuntu 12.04 LTS (precise) - low.
    2016-12-11
    oval:com.ubuntu.trusty:def:20169423000
    V
    		CVE-2016-9423 on Ubuntu 14.04 LTS (trusty) - low.
    2016-12-11
    oval:com.ubuntu.xenial:def:20169423000
    V
    		CVE-2016-9423 on Ubuntu 16.04 LTS (xenial) - low.
    2016-12-11
    BACK
    w3m_project w3m *