CVE-2023-4255
Fixed in a distro release EPSS <1%CVSS 5.5
An out-of-bounds write issue has been discovered in the backspace handling of the checkType() function in etc.c within the W3M application. This vulnerability is triggered by supplying a specially crafted HTML file to the w3m binary. Exploitation of this flaw could lead to application crashes, resulting in a denial of service condition.
Products: Fedora, Fedora Extra Packages for Enterprise Linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | w3m | no fix |
| Debian 13 | w3m | 0.5.3+git20230121-2.1 |
| Debian 14 | w3m | 0.5.3+git20230121-2.1 |
| SUSE Linux Enterprise Server 12 SP5 | w3m | 0.5.3.git20161120-161.9.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | w3m | 0.5.3.git20161120-161.9.1 |
| Ubuntu 16.04 LTS | w3m | no fix |
| Ubuntu 20.04 LTS | w3m | 0.5.3-37ubuntu0.2 |
| Ubuntu 22.04 LTS | w3m | 0.5.3+git20210102-6ubuntu0.2 |
| Ubuntu 24.04 LTS | w3m | 0.5.3+git20230121-2ubuntu1 |
| Ubuntu Pro 14.04 LTS | w3m | 0.5.3-15ubuntu0.2+esm2 |
| Ubuntu Pro 18.04 LTS | w3m | 0.5.3-36ubuntu0.1+esm1 |