CVE-2006-6772: Critical severity w3m w3m vulnerability
Format string vulnerability in the inputAnswer function in file.c in w3m before 0.5.2, when run with the dump or backend option, allows remote attackers to execute arbitrary code via format string specifiers in the Common Name (CN) field of an SSL certificate associated with an https URL.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-6772?
CVE-2006-6772 has been classified as a critical vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2006-6772?
To mitigate CVE-2006-6772, upgrade w3m to version 0.5.2 or later, where the vulnerability has been addressed.
What versions of w3m are affected by CVE-2006-6772?
CVE-2006-6772 affects w3m versions prior to 0.5.2, specifically version 0.5.1.
Can CVE-2006-6772 be exploited remotely?
Yes, CVE-2006-6772 can be exploited remotely through malicious SSL certificates with crafted format string specifiers.
What are the potential consequences of CVE-2006-6772?
Exploitation of CVE-2006-6772 could allow attackers to execute arbitrary code on the vulnerable system.