Remote attackers can crash Lynx and Internet Explorer using an IMG tag with a large width parameter.
Description of problem:
Lynx reads .mailcap and .mime.types from its CWD, making it possible for a malicious person to make it execute arbitrairy code when user launches lynx while its working directory contains attacker-provided contents.
Steps to Reproduce:
$ cat .mime.types application/x-bug bug $ cat .mailcap application/x-bug; xmessage 'Hello, World!' $ cat poc.bug $ lynx poc.bug
( xmessage 'Hello, World!' ) < /home/lkundrak/L28618-1037TMP.bin
...
Fix:
Make lynx read files from ~ instead of CWD. Debian patch is unusable here, they completly remove code for reading the files in question.
Heap-based buffer overflow in the converttoidna function in WWW/Library/Implementation/HTParse.c in Lynx 2.8.8dev.1 through 2.8.8dev.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed URL containing a % (percent) character in the domain name.