Heap-based buffer overflow in the converttoidna function in WWW/Library/Implementation/HTParse.c in Lynx 2.8.8dev.1 through 2.8.8dev.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed URL containing a % (percent) character in the domain name.

Description of problem:

Lynx reads .mailcap and .mime.types from its CWD, making it possible for a malicious person to make it execute arbitrairy code when user launches lynx while its working directory contains attacker-provided contents.

Steps to Reproduce:

$ cat .mime.types application/x-bug bug $ cat .mailcap application/x-bug; xmessage 'Hello, World!' $ cat poc.bug $ lynx poc.bug

( xmessage 'Hello, World!' ) < /home/lkundrak/L28618-1037TMP.bin

...

Fix:

Make lynx read files from ~ instead of CWD. Debian patch is unusable here, they completly remove code for reading the files in question.

Remote attackers can crash Lynx and Internet Explorer using an IMG tag with a large width parameter.