CVE-2016-9435
Fixed in a distro release EPSS 3%
The HTMLtagproc1 function in file.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application via a crafted html file, related to <dd> tags.
Products: opensuse leap, opensuse_project leap, tats w3m
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | w3m | 0.5.3.git20161031-1 |
| Debian 12 | w3m | 0.5.3-30 |
| Debian 13 | w3m | 0.5.3-30 |
| Debian 14 | w3m | 0.5.3-30 |
| SUSE Linux Enterprise Desktop 12 SP1 | w3m | 0.5.3.git20161120-160.1 |
| SUSE Linux Enterprise Desktop 12 SP2 | w3m | 0.5.3.git20161120-160.1 |
| SUSE Linux Enterprise Server 11 SP4 | w3m | 0.5.3.git20161120-4.1 |
| SUSE Linux Enterprise Server 12 SP1 | w3m | 0.5.3.git20161120-160.1 |
| SUSE Linux Enterprise Server 12 SP2 | w3m | 0.5.3.git20161120-160.1 |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 | w3m | 0.5.3.git20161120-160.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | w3m | 0.5.3.git20161120-4.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | w3m | 0.5.3.git20161120-160.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | w3m | 0.5.3.git20161120-160.1 |
| Ubuntu 14.04 LTS | w3m | 0.5.3-15ubuntu0.1 |
| Ubuntu 16.04 LTS | w3m | 0.5.3-26ubuntu0.1 |
| openSUSE Tumbleweed | w3m | 0.5.3.git20161120-1.1 |