CVE-2016-9428

Published: 11 December 2016

An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. Heap-based buffer overflow in the addMultirowsForm function in w3m allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML page.

Priority

Medium

CVSS 3 base score: 8.8

Status

Notes

same fix/workaround as for CVE-2016-9425

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9428
• https://github.com/tats/w3m/issues/26
• http://www.openwall.com/lists/oss-security/2016/11/18/3
• https://ubuntu.com/security/notices/USN-3214-1
• NVD
• Launchpad
• Debian

Bugs