CVE-2023-4255
W3m: out-of-bounds write in function checktype() in etc.c (incomplete fix for cve-2022-38223)
Severity Score
5.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
An out-of-bounds write issue has been discovered in the backspace handling of the checkType() function in etc.c within the W3M application. This vulnerability is triggered by supplying a specially crafted HTML file to the w3m binary. Exploitation of this flaw could lead to application crashes, resulting in a denial of service condition.
Se descubrió un problema de escritura fuera de los límites en el manejo de retroceso de la función checkType() en etc.c dentro de la aplicación W3M. Esta vulnerabilidad se activa al proporcionar un archivo HTML especialmente manipulado al binario w3m. La explotación de este fallo podría provocar fallos en la aplicación, lo que resultaría en una condición de denegación de servicio.
*Credits:
Red Hat would like to thank iskindar97@gmail.com for reporting this issue.
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2023-08-08 CVE Reserved
- 2023-12-21 CVE Published
- 2024-03-27 EPSS Updated
- 2024-08-02 CVE Updated
- 2024-08-02 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-787: Out-of-bounds Write
CAPEC
References (7)
URL | Date | SRC |
---|---|---|
https://github.com/tats/w3m/issues/268 | 2024-08-02 |
URL | Date | SRC |
---|---|---|
https://github.com/tats/w3m/commit/edc602651c506aeeb60544b55534dd1722a340d3 | 2024-03-27 | |
https://github.com/tats/w3m/pull/273 | 2024-03-27 |
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Tats Search vendor "Tats" | W3m Search vendor "Tats" for product "W3m" | 0.5.3\+git20230121-1 Search vendor "Tats" for product "W3m" and version "0.5.3\+git20230121-1" | - |
Affected
| ||||||
Tats Search vendor "Tats" | W3m Search vendor "Tats" for product "W3m" | 0.5.3\+git20230121-2 Search vendor "Tats" for product "W3m" and version "0.5.3\+git20230121-2" | - |
Affected
| ||||||
Tats Search vendor "Tats" | W3m Search vendor "Tats" for product "W3m" | 0.5.3\+git20230129 Search vendor "Tats" for product "W3m" and version "0.5.3\+git20230129" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Extra Packages For Enterprise Linux Search vendor "Fedoraproject" for product "Extra Packages For Enterprise Linux" | 8.0 Search vendor "Fedoraproject" for product "Extra Packages For Enterprise Linux" and version "8.0" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 39 Search vendor "Fedoraproject" for product "Fedora" and version "39" | - |
Affected
|