CVE-2022-38223
Fixed in a distro release EPSS <1%
There is an out-of-bounds write in checkType located in etc.c in w3m 0.5.3. It can be triggered by sending a crafted HTML file to the w3m binary. It allows an attacker to cause Denial of Service or possibly have unspecified other impact.
Products: tats w3m, fedoraproject fedora
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.23 | w3m | 0.5.3_git20241203-r0 |
| Debian 10 | w3m | 0.5.3-37+deb10u1 |
| Debian 12 | w3m | 0.5.3+git20230121-1 |
| Debian 13 | w3m | 0.5.3+git20230121-1 |
| Debian 14 | w3m | 0.5.3+git20230121-1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP4 | w3m | 0.5.3+git20180125-150000.3.3.1 |
| SUSE Linux Enterprise Real Time 15 SP3 | w3m | 0.5.3+git20180125-150000.3.3.1 |
| SUSE Linux Enterprise Server 12 SP5 | w3m | 0.5.3.git20161120-161.6.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | w3m | 0.5.3.git20161120-161.6.1 |
| Ubuntu 16.04 LTS | w3m | no fix |
| Ubuntu 18.04 LTS | w3m | 0.5.3-36ubuntu0.1 |
| Ubuntu 20.04 LTS | w3m | 0.5.3-37ubuntu0.1 |
| Ubuntu 22.04 LTS | w3m | 0.5.3+git20210102-6ubuntu0.1 |
| Ubuntu Pro 14.04 LTS | w3m | 0.5.3-15ubuntu0.2+esm1 |
| openSUSE Leap 15.4 | w3m | 0.5.3+git20180125-150000.3.3.1 |
| openSUSE Tumbleweed | w3m | 0.5.3+git20180125-2.1 |