CVE-2023-4255 - Vulnerability Details - OpenCVE

ReportizFlow

An out-of-bounds write issue has been discovered in the backspace handling of the checkType() function in etc.c within the W3M application. This vulnerability is triggered by supplying a specially crafted HTML file to the w3m binary. Exploitation of this flaw could lead to application crashes, resulting in a denial of service condition.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Fedoraproject	Extra Packages For Enterprise Linux Fedora
Tats	W3m

Configuration 1 [-]

OR	cpe:2.3:a:tats:w3m:0.5.3\+git20230121-1:::::::*
	cpe:2.3:a:tats:w3m:0.5.3\+git20230121-2:::::::*
	cpe:2.3:a:tats:w3m:0.5.3\+git20230129:::::::*

Configuration 2 [-]

OR	cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:::::::*
	cpe:2.3:o:fedoraproject:fedora:39:::::::*

No data.

References

Link	Providers
https://bugzilla.redhat.com/show_bug.cgi?id=2255207
https://github.com/tats/w3m/commit/edc602651c506aeeb60544b55534dd1722a340d3
https://github.com/tats/w3m/issues/268
https://github.com/tats/w3m/pull/273
https://lists.fedoraproject.org/archives/list/[email protected]/message/AULOBQJLXE2KCT5UVQMKGEFL4GFIAOED/
https://lists.fedoraproject.org/archives/list/[email protected]/message/MKFZQUK7FPWWJQYICDZZ4YWIPUPQ2D3R/
https://lists.fedoraproject.org/archives/list/[email protected]/message/TODROGVCWZ435HQIZE6ARQC5LPQLIA5C/

History

No history.

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2023-12-21T16:08:39.691Z

Updated: 2024-08-02T07:24:03.587Z

Reserved: 2023-08-08T20:16:01.838Z

Link: CVE-2023-4255

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-12-21T16:15:10.017

Modified: 2024-11-21T08:34:44.253

Link: CVE-2023-4255

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-4255", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2023-08-08T20:16:01.838Z", "datePublished": "2023-12-21T16:08:39.691Z", "dateUpdated": "2024-08-02T07:24:03.587Z"}, "containers": {"cna": {"title": "W3m: out-of-bounds write in function checktype() in etc.c (incomplete fix for cve-2022-38223)", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "An out-of-bounds write issue has been discovered in the backspace handling of the checkType() function in etc.c within the W3M application. This vulnerability is triggered by supplying a specially crafted HTML file to the w3m binary. Exploitation of this flaw could lead to application crashes, resulting in a denial of service condition."}], "affected": [{"product": "w3m", "vendor": "n/a", "defaultStatus": "affected"}, {"product": "Fedora", "vendor": "Fedora", "collectionURL": "https://packages.fedoraproject.org/", "packageName": "w3m", "defaultStatus": "affected"}, {"product": "Extra Packages for Enterprise Linux", "vendor": "Fedora", "collectionURL": "https://packages.fedoraproject.org/", "packageName": "w3m", "defaultStatus": "affected"}], "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2255207", "name": "RHBZ#2255207", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://github.com/tats/w3m/commit/edc602651c506aeeb60544b55534dd1722a340d3"}, {"url": "https://github.com/tats/w3m/issues/268"}, {"url": "https://github.com/tats/w3m/pull/273"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/AULOBQJLXE2KCT5UVQMKGEFL4GFIAOED/"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/TODROGVCWZ435HQIZE6ARQC5LPQLIA5C/"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/MKFZQUK7FPWWJQYICDZZ4YWIPUPQ2D3R/"}], "datePublic": "2023-06-12T00:00:00+00:00", "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "description": "Out-of-bounds Write", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-787: Out-of-bounds Write", "timeline": [{"lang": "en", "time": "2023-07-19T00:00:00+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2023-06-12T00:00:00+00:00", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank [email protected] for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2023-12-21T16:08:39.691Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:24:03.587Z"}, "title": "CVE Program Container", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2255207", "name": "RHBZ#2255207", "tags": ["issue-tracking", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://github.com/tats/w3m/commit/edc602651c506aeeb60544b55534dd1722a340d3", "tags": ["x_transferred"]}, {"url": "https://github.com/tats/w3m/issues/268", "tags": ["x_transferred"]}, {"url": "https://github.com/tats/w3m/pull/273", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/AULOBQJLXE2KCT5UVQMKGEFL4GFIAOED/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/TODROGVCWZ435HQIZE6ARQC5LPQLIA5C/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/MKFZQUK7FPWWJQYICDZZ4YWIPUPQ2D3R/", "tags": ["x_transferred"]}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tats:w3m:0.5.3\\+git20230121-1:*:*:*:*:*:*:*", "matchCriteriaId": "7A31CA22-C625-4E9C-9C57-CCDBC9E9B99A", "vulnerable": true}, {"criteria": "cpe:2.3:a:tats:w3m:0.5.3\\+git20230121-2:*:*:*:*:*:*:*", "matchCriteriaId": "9E2BDFFC-F30D-47CE-B32E-E4C1713ACF1C", "vulnerable": true}, {"criteria": "cpe:2.3:a:tats:w3m:0.5.3\\+git20230129:*:*:*:*:*:*:*", "matchCriteriaId": "BB9F94C4-C1FC-4CD9-B5B4-E745E4B3BCBC", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "BB176AC3-3CDA-4DDA-9089-C67B2F73AA62", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*", "matchCriteriaId": "B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An out-of-bounds write issue has been discovered in the backspace handling of the checkType() function in etc.c within the W3M application. This vulnerability is triggered by supplying a specially crafted HTML file to the w3m binary. Exploitation of this flaw could lead to application crashes, resulting in a denial of service condition."}, {"lang": "es", "value": "Se descubri\u00f3 un problema de escritura fuera de los l\u00edmites en el manejo de retroceso de la funci\u00f3n checkType() en etc.c dentro de la aplicaci\u00f3n W3M. Esta vulnerabilidad se activa al proporcionar un archivo HTML especialmente manipulado al binario w3m. La explotaci\u00f3n de este fallo podr\u00eda provocar fallos en la aplicaci\u00f3n, lo que resultar\u00eda en una condici\u00f3n de denegaci\u00f3n de servicio."}], "id": "CVE-2023-4255", "lastModified": "2024-11-21T08:34:44.253", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2023-12-21T16:15:10.017", "references": [{"source": "[email protected]", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2255207"}, {"source": "[email protected]", "tags": ["Patch"], "url": "https://github.com/tats/w3m/commit/edc602651c506aeeb60544b55534dd1722a340d3"}, {"source": "[email protected]", "tags": ["Exploit", "Issue Tracking", "Patch"], "url": "https://github.com/tats/w3m/issues/268"}, {"source": "[email protected]", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/tats/w3m/pull/273"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/AULOBQJLXE2KCT5UVQMKGEFL4GFIAOED/"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/MKFZQUK7FPWWJQYICDZZ4YWIPUPQ2D3R/"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/TODROGVCWZ435HQIZE6ARQC5LPQLIA5C/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2255207"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/tats/w3m/commit/edc602651c506aeeb60544b55534dd1722a340d3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Patch"], "url": "https://github.com/tats/w3m/issues/268"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/tats/w3m/pull/273"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/AULOBQJLXE2KCT5UVQMKGEFL4GFIAOED/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/MKFZQUK7FPWWJQYICDZZ4YWIPUPQ2D3R/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/TODROGVCWZ435HQIZE6ARQC5LPQLIA5C/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "[email protected]", "type": "Primary"}]}