CVE-2018-6198: Medium severity tats w3m vulnerability
Last updated 25 August 2025
Other sources
w3m through 0.5.3 does not properly handle temporary files when the ~/.w3m directory is unwritable, which allows a local attacker to craft a symlink attack to overwrite arbitrary files.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/w3mto a version that resolves this vulnerability.Fixed in 0.5.3+git20210102-6+deb11u1Fixed in 0.5.3+git20230121-2Fixed in 0.5.3+git20230121-2.1Fixed in 0.5.3+git20230121-2.3 - Upgrade
Upgrade
w3mto a version that resolves this vulnerability.Fixed in 0.5.3
Event History
Frequently Asked Questions
What is the vulnerability CVE-2018-6198?
CVE-2018-6198 is a vulnerability in the w3m web browser that allows a local attacker to craft a symlink attack and overwrite arbitrary files when the ~/.w3m directory is unwritable.
How does CVE-2018-6198 affect w3m?
CVE-2018-6198 affects w3m versions through 0.5.3.
What is the severity of CVE-2018-6198?
The severity of CVE-2018-6198 is medium, with a CVSS score of 4.7.
How can I fix the CVE-2018-6198 vulnerability in w3m?
To fix the CVE-2018-6198 vulnerability in w3m, upgrade to version 0.5.3-37 or later.
Are there any references for CVE-2018-6198?
Yes, you can find references for CVE-2018-6198 at the following links: [Reference 1](http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00028.html), [Reference 2](http://www.securityfocus.com/bid/102855), [Reference 3](https://bugs.debian.org/888097).