CVE-2023-38253
Fixed in a distro release EPSS <1%CVSS 4.7
An out-of-bounds read flaw was found in w3m, in the growbuf_to_Str function in indep.c. This issue may allow an attacker to cause a denial of service through a crafted HTML file.
Products: Red Hat Enterprise Linux 6, Fedora Extra Packages for Enterprise Linux, Fedora
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.23 | w3m | 0.5.3_git20241203-r0 |
| Debian 12 | w3m | no fix |
| Debian 13 | w3m | no fix |
| Debian 14 | w3m | no fix |
| SUSE Linux Enterprise Module for Basesystem 15 SP4 | w3m | 0.5.3+git20230121-150000.3.6.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP5 | w3m | 0.5.3+git20230121-150000.3.6.1 |
| Ubuntu 16.04 LTS | w3m | no fix |
| Ubuntu 20.04 LTS | w3m | 0.5.3-37ubuntu0.2 |
| Ubuntu 22.04 LTS | w3m | 0.5.3+git20210102-6ubuntu0.2 |
| Ubuntu 24.04 LTS | w3m | 0.5.3+git20230121-2ubuntu1 |
| Ubuntu Pro 14.04 LTS | w3m | no fix |
| Ubuntu Pro 18.04 LTS | w3m | 0.5.3-36ubuntu0.1+esm1 |
| openSUSE Leap 15.4 | w3m | 0.5.3+git20230121-150000.3.6.1 |
| openSUSE Leap 15.5 | w3m | 0.5.3+git20230121-150000.3.6.1 |
| openSUSE Tumbleweed | w3m | 0.5.3+git20230121-2.1 |