It was found that Lynx doesn't parse the authority component of the URL correctly

Lynx does not verify that the server's certificate is signed by a trusted certification authority, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate, related to improper use of a certain GnuTLS function.

lynx 2.8.6dev.15 and earlier, when advanced mode is enabled and lynx is configured as a URL handler, allows remote attackers to execute arbitrary commands via a crafted lynxcgi: URL, a related issue to CVE-2005-2929. NOTE: this might only be a vulnerability in limited deployments that have defined a lynxcgi: handler.

Description of problem:

Lynx reads .mailcap and .mime.types from its CWD, making it possible for a malicious person to make it execute arbitrairy code when user launches lynx while its working directory contains attacker-provided contents.

Steps to Reproduce:

$ cat .mime.types application/x-bug bug $ cat .mailcap application/x-bug; xmessage 'Hello, World!' $ cat poc.bug $ lynx poc.bug

( xmessage 'Hello, World!' ) < /home/lkundrak/L28618-1037TMP.bin

...

Fix:

Make lynx read files from ~ instead of CWD. Debian patch is unusable here, they completly remove code for reading the files in question.