Bug 1011280 – VUL-0: CVE-2016-9431: w3m: stack overflow

Bug 1011280 - (CVE-2016-9431) VUL-0: CVE-2016-9431: w3m: stack overflow

(CVE-2016-9431)
Summary:	VUL-0: CVE-2016-9431: w3m: stack overflow

Status:	RESOLVED FIXED

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal
Target Milestone:	---
Assigned To:	Thomas Blume
QA Contact:	Security Team bot

URL:
Whiteboard:	CVSSv2:RedHat:CVE-2016-9431:4.3:(AV:N...
Keywords:

Depends on:
Blocks:	1011293
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2016-11-21 12:04 UTC by Alexander Bergmann
Modified:	2018-05-03 22:41 UTC (History)
CC List:	2 users (show)

See Also:
Found By:	---
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Alexander Bergmann 2016-11-21 12:04:47 UTC

w3m: multiple vulnerabilities
http://seclists.org/oss-sec/2016/q4/452

stackoverflow in deleteFrameSet() on malform input

Issue: https://github.com/tats/w3m/issues/10

Comment 1 Swamp Workflow Management 2016-11-21 22:59:11 UTC

bugbot adjusting priority

Comment 2 Alexander Bergmann 2016-11-22 08:55:22 UTC

Upstream Fix:
https://github.com/tats/w3m/commit/9f0bdcfdf061db3520bd1f112bdc5e83acdec4be

Comment 3 Alexander Bergmann 2016-11-22 09:01:11 UTC

The fixes in bsc#1011281 are superseding the fix from comment 2.

Therefore the final commit fixes several CVEs at ones.

Comment 4 Thomas Blume 2017-05-11 07:51:14 UTC

closing

Comment 6 Johannes Segitz 2018-05-03 13:29:02 UTC

also fixed in tracker bug 1011293