Description of problem:

Lynx reads .mailcap and .mime.types from its CWD, making it possible for a malicious person to make it execute arbitrairy code when user launches lynx while its working directory contains attacker-provided contents.

Steps to Reproduce:

$ cat .mime.types application/x-bug bug $ cat .mailcap application/x-bug; xmessage 'Hello, World!' $ cat poc.bug $ lynx poc.bug

( xmessage 'Hello, World!' ) < /home/lkundrak/L28618-1037TMP.bin

...

Fix:

Make lynx read files from ~ instead of CWD. Debian patch is unusable here, they completly remove code for reading the files in question.