CVE-2023-38252

An out-of-bounds read flaw was found in w3m, in the Strnew_size function in Str.c. This issue may allow an attacker to cause a denial of service through a crafted HTML file.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.7 MEDIUM
LOCAL
HIGH
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
redhatCNA
4.7 MEDIUM
LOCAL
HIGH
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 1%
VendorProductVersion
tatsw3m
0.5.3\+git20230121
fedoraprojectextra_packages_for_enterprise_linux
8.0
redhatenterprise_linux
6.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
w3m
bullseye
unimportant
trixie
unimportant
bookworm
unimportant
sid
unimportant
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
w3m
oracular
Fixed 0.5.3+git20230121-2ubuntu1
released
noble
Fixed 0.5.3+git20230121-2ubuntu1
released
mantic
Fixed 0.5.3+git20230121-2ubuntu0.23.10.1
released
lunar
Fixed 0.5.3+git20230121-2ubuntu0.23.04.1
released
kinetic
ignored
jammy
Fixed 0.5.3+git20210102-6ubuntu0.2
released
focal
Fixed 0.5.3-37ubuntu0.2
released
bionic
Fixed 0.5.3-36ubuntu0.1+esm1
released
xenial
needs-triage
trusty
ignored
Common Weakness Enumeration
References
https://access.redhat.com/security/cve/CVE-2023-38252
https://bugzilla.redhat.com/show_bug.cgi?id=2222775
https://github.com/tats/w3m/issues/270
https://access.redhat.com/security/cve/CVE-2023-38252
https://bugzilla.redhat.com/show_bug.cgi?id=2222775
https://github.com/tats/w3m/issues/270
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AULOBQJLXE2KCT5UVQMKGEFL4GFIAOED/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKFZQUK7FPWWJQYICDZZ4YWIPUPQ2D3R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TODROGVCWZ435HQIZE6ARQC5LPQLIA5C/