Executive Summary
| Summary | |
|---|---|
| Title | New w3m packages fix cookie information leak |
| Informations | |||
|---|---|---|---|
| Name | DSA-251 | First vendor Publication | 2003-02-14 |
| Vendor | Debian | Last vendor Modification | 2003-02-14 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Hironori Sakamoto, one of the w3m developers, found two security vulnerabilities in w3m and associated programs. The w3m browser does not properly escape HTML tags in frame contents and img alt attributes. A malicious HTML frame or img alt attribute may deceive a user to send his local cookies which are used for configuration. The information is not leaked automatically, though. For the stable distribution (woody) these problems have been fixed in version 0.3-2.4. The old stable distribution (potato) is not affected by these problems. For the unstable distribution (sid) these problems have been fixed in version 0.3.2.2-1 and later. We recommend that you upgrade your w3m and w3m-ssl packages. |
Original Source
| Url : http://www.debian.org/security/2003/dsa-251 |
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2008-01-17 | Name : Debian Security Advisory DSA 249-1 (w3mmee) File : nvt/deb_249_1.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 250-1 (w3mmee-ssl) File : nvt/deb_250_1.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 251-1 (w3m, w3m-ssl) File : nvt/deb_251_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 14526 | w3m IMG Tag ALT Attribute HTML Tags XSS |
| 6981 | w3m Unspecified Frame XSS w3m contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not escape an html tag in a frame. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2004-09-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-249.nasl - Type : ACT_GATHER_INFO |
| 2004-09-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-250.nasl - Type : ACT_GATHER_INFO |
| 2004-09-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-251.nasl - Type : ACT_GATHER_INFO |
| 2004-07-06 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2003-045.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:31:13 |
|
