[Fedora-i18n-bugs] [Bug 1399682] New: CVE-2016-9430 w3m: Global-buffer-overflow write in formUpdateBuffer

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1399682

            Bug ID: 1399682
           Summary: CVE-2016-9430 w3m: Global-buffer-overflow write in
                    formUpdateBuffer
           Product: Security Response
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: security-response-team(a)redhat.com
          Reporter: anemec(a)redhat.com
                CC: eng-i18n-bugs(a)redhat.com,
                    i18n-bugs(a)lists.fedoraproject.org, pnemade(a)redhat.com




A global-buffer-overflow write will occur in w3m while parsing maliciously
crafted input.

Upstream bug:

https://github.com/tats/w3m/issues/29

Upstream fix:

https://github.com/tats/w3m/commit/d01de738f599441740437c6600dd5b1ae7155d27

References:

http://seclists.org/oss-sec/2016/q4/321

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Fedora-i18n-bugs] [Bug 1399682] CVE-2016-9429 w3m: Global-buffer-overflow write in formUpdateBuffer

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1399682

Andrej Nemec <anemec(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|CVE-2016-9430 w3m:          |CVE-2016-9429 w3m:
                   |Global-buffer-overflow      |Global-buffer-overflow
                   |write in formUpdateBuffer   |write in formUpdateBuffer
              Alias|CVE-2016-9430               |CVE-2016-9429



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Fedora-i18n-bugs] [Bug 1399682] CVE-2016-9429 w3m: Global-buffer-overflow write in formUpdateBuffer

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1399682

Andrej Nemec <anemec(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |1399744



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Fedora-i18n-bugs] [Bug 1399682] CVE-2016-9429 w3m: Global-buffer-overflow write in formUpdateBuffer

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1399682

Huzaifa S. Sidhpurwala <huzaifas(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1401423
         Depends On|                            |1401424



--- Comment #1 from Huzaifa S. Sidhpurwala <huzaifas(a)redhat.com&gt; ---

Created w3m tracking bugs for this issue:

Affects: fedora-all [bug 1401423]
Affects: epel-7 [bug 1401424]


Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1401423
[Bug 1401423] w3m: various flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1401424
[Bug 1401424] w3m: various flaws [epel-7]
-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Fedora-i18n-bugs] [Bug 1399682] CVE-2016-9429 w3m: Global-buffer-overflow write in formUpdateBuffer

https://bugzilla.redhat.com/show_bug.cgi?id=1399682
Bug 1399682 depends on bug 1401423, which changed state.

Bug 1401423 Summary: w3m: various flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1401423

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ON_QA                       |CLOSED
         Resolution|---                         |ERRATA



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Fedora-i18n-bugs] [Bug 1399682] CVE-2016-9429 w3m: Global-buffer-overflow write in formUpdateBuffer

https://bugzilla.redhat.com/show_bug.cgi?id=1399682

Dhiru Kholia <dkholia(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|medium                      |low
             Status|NEW                         |CLOSED
         Resolution|---                         |NOTABUG
         Whiteboard|impact=moderate,public=2016 |impact=low,public=20161003,
                   |1003,reported=20161103,sour |reported=20161103,source=os
                   |ce=oss-security,cvss2=6.8/A |s-security,cvss2=2.6/AV:N/A
                   |V:N/AC:M/Au:N/C:P/I:P/A:P,c |C:H/Au:N/C:N/I:N/A:P,cvss3=
                   |vss3=8.8/CVSS:3.0/AV:N/AC:L |4.3/CVSS:3.0/AV:N/AC:L/PR:N
                   |/PR:N/UI:R/S:U/C:H/I:H/A:H, |/UI:R/S:U/C:N/I:N/A:L,cwe=C
                   |cwe=CWE-787,fedora-all/w3m= |WE-787,fedora-all/w3m=affec
                   |affected,epel-7/w3m=affecte |ted,epel-7/w3m=affected,rhe
                   |d,rhel-5/w3m=new,rhel-6/w3m |l-5/w3m=notaffected,rhel-6/
                   |=new                        |w3m=notaffected
           Severity|medium                      |low
        Last Closed|                            |2017-03-21 03:30:14



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Fedora-i18n-bugs] [Bug 1399682] CVE-2016-9429 w3m: Global-buffer-overflow write in formUpdateBuffer

https://bugzilla.redhat.com/show_bug.cgi?id=1399682
Bug 1399682 depends on bug 1401424, which changed state.

Bug 1401424 Summary: w3m: various flaws [epel-7]
https://bugzilla.redhat.com/show_bug.cgi?id=1401424

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ON_QA                       |CLOSED
         Resolution|---                         |ERRATA



-- 
You are receiving this mail because:
You are on the CC list for the bug.