See how lynx compares to other vendors in security performance
Remote attackers can crash Lynx and Internet Explorer using an IMG tag with a large width parameter.
lynx 2.8.6dev.15 and earlier, when advanced mode is enabled and lynx is configured as a URL handler, allows remote attackers to execute arbitrary commands via a crafted lynxcgi: URL, a related issue to CVE-2005-2929. NOTE: this might only be a vulnerability in limited deployments that have defined a lynxcgi: handler.
It was found that Lynx doesn't parse the authority component of the URL correctly
Heap-based buffer overflow in the converttoidna function in WWW/Library/Implementation/HTParse.c in Lynx 2.8.8dev.1 through 2.8.8dev.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed URL containing a % (percent) character in the domain name.
Lynx does not verify that the server's certificate is signed by a trusted certification authority, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate, related to improper use of a certain GnuTLS function.
Description of problem:
Lynx reads .mailcap and .mime.types from its CWD, making it possible for a malicious person to make it execute arbitrairy code when user launches lynx while its working directory contains attacker-provided contents.
Steps to Reproduce:
$ cat .mime.types application/x-bug bug $ cat .mailcap application/x-bug; xmessage 'Hello, World!' $ cat poc.bug $ lynx poc.bug
( xmessage 'Hello, World!' ) < /home/lkundrak/L28618-1037TMP.bin
...
Fix:
Make lynx read files from ~ instead of CWD. Debian patch is unusable here, they completly remove code for reading the files in question.
Description of problem:
Lynx reads .mailcap and .mime.types from its CWD, making it possible for a malicious person to make it execute arbitrairy code when user launches lynx while its working directory contains attacker-provided contents.
Steps to Reproduce:
$ cat .mime.types application/x-bug bug $ cat .mailcap application/x-bug; xmessage 'Hello, World!' $ cat poc.bug $ lynx poc.bug
( xmessage 'Hello, World!' ) < /home/lkundrak/L28618-1037TMP.bin
...
Fix:
Make lynx read files from ~ instead of CWD. Debian patch is unusable here, they completly remove code for reading the files in question.