See how lynx compares to other vendors in security performance
Remote attackers can crash Lynx and Internet Explorer using an IMG tag with a large width parameter.
It was found that Lynx doesn't parse the authority component of the URL correctly
Description of problem:
Lynx reads .mailcap and .mime.types from its CWD, making it possible for a malicious person to make it execute arbitrairy code when user launches lynx while its working directory contains attacker-provided contents.
Steps to Reproduce:
$ cat .mime.types application/x-bug bug $ cat .mailcap application/x-bug; xmessage 'Hello, World!' $ cat poc.bug $ lynx poc.bug
( xmessage 'Hello, World!' ) < /home/lkundrak/L28618-1037TMP.bin
...
Fix:
Make lynx read files from ~ instead of CWD. Debian patch is unusable here, they completly remove code for reading the files in question.
lynx 2.8.6dev.15 and earlier, when advanced mode is enabled and lynx is configured as a URL handler, allows remote attackers to execute arbitrary commands via a crafted lynxcgi: URL, a related issue to CVE-2005-2929. NOTE: this might only be a vulnerability in limited deployments that have defined a lynxcgi: handler.
Heap-based buffer overflow in the converttoidna function in WWW/Library/Implementation/HTParse.c in Lynx 2.8.8dev.1 through 2.8.8dev.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed URL containing a % (percent) character in the domain name.
Lynx does not verify that the server's certificate is signed by a trusted certification authority, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate, related to improper use of a certain GnuTLS function.
Description of problem:
Lynx reads .mailcap and .mime.types from its CWD, making it possible for a malicious person to make it execute arbitrairy code when user launches lynx while its working directory contains attacker-provided contents.
Steps to Reproduce:
$ cat .mime.types application/x-bug bug $ cat .mailcap application/x-bug; xmessage 'Hello, World!' $ cat poc.bug $ lynx poc.bug
( xmessage 'Hello, World!' ) < /home/lkundrak/L28618-1037TMP.bin
...
Fix:
Make lynx read files from ~ instead of CWD. Debian patch is unusable here, they completly remove code for reading the files in question.