CVSS: 7.8EPSS: 1%CPEs: 4EXPL: 1CVE-2008-7224 – elinks: entity_cache static array buffer overflow (off-by-one)
https://notcve.org/view.php?id=CVE-2008-7224
Buffer overflow in entity_cache in ELinks before 0.11.4rc0 allows remote attackers to cause a denial of service (crash) via a crafted link. Desbordamiento de búfer en entity_cache de ELinks anterior a v0.11.4rc0, permite a atacantes remotos provocar una denegación de servicio (caída) a través de un enlace manipulado. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=380347 http://linuxfromscratch.org/pipermail/elinks-users/2008-February/001604.html http://osvdb.org/41949 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10126 https://access.redhat.com/security/cve/CVE-2008-7224 https://bugzilla.redhat.com/show_bug.cgi?id=523258 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-193: Off-by-one Error •
CVSS: 4.3EPSS: 1%CPEs: 2EXPL: 0CVE-2007-5034 – elinks reveals POST data to HTTPS proxy
https://notcve.org/view.php?id=CVE-2007-5034
ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy is defined for https. ELinks anterior a la versión 0.11.3, cuando envía una petición POST para un URL https, añade el cuerpo y cabeceras de contenido de la petición POST a la petición CONNECT en texto plano, lo que permite a atacantes remotos recoger (sniff) datos sensible que deberían de haberse protegido con TLS. NOTA: esta vulnerabilidad sólo ocurre cuando el proxy está definido por https. • http://bugzilla.elinks.cz/show_bug.cgi?id=937 http://secunia.com/advisories/26936 http://secunia.com/advisories/26949 http://secunia.com/advisories/26956 http://secunia.com/advisories/27038 http://secunia.com/advisories/27062 http://secunia.com/advisories/27125 http://secunia.com/advisories/27132 http://www.debian.org/security/2007/dsa-1380 http://www.redhat.com/support/errata/RHSA-2007-0933.html http://www.securityfocus.com/archive/1/481606/100/0/threaded http:/ • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.4EPSS: 0%CPEs: 1EXPL: 2CVE-2007-2027 – ELinks Relative 0.10.6/011.1 - Path Arbitrary Code Execution
https://notcve.org/view.php?id=CVE-2007-2027
Untrusted search path vulnerability in the add_filename_to_string function in intl/gettext/loadmsgcat.c for Elinks 0.11.1 allows local users to cause Elinks to use an untrusted gettext message catalog (.po file) in a "../po" directory, which can be leveraged to conduct format string attacks. Una vulnerabilidad de ruta (path) de búsqueda no confiable en la función add_filename_to_string en el archivo intl/gettext/loadmsgcat.c para Elinks versión 0.11.1, permite a usuarios locales causar que Elinks use un catálogo de mensajes gettext no confiable (archivo .po) en un directorio "../po", que puede ser aprovechado para conducir ataques de cadena de formato. • https://www.exploit-db.com/exploits/29954 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=417789 http://osvdb.org/35668 http://secunia.com/advisories/25169 http://secunia.com/advisories/25198 http://secunia.com/advisories/25255 http://secunia.com/advisories/25550 http://security.gentoo.org/glsa/glsa-200706-03.xml http://www.securityfocus.com/bid/23844 http://www.trustix.org/errata/2007/0017 http://www.ubuntu.com/usn/usn-457-1 http://www.vupen.com/engli • CWE-134: Use of Externally-Controlled Format String •