Log in Start free

Vulnerability · Published Jul 14, 2023 · Assigned by redhat

CVE-2023-38253W3m: out of bounds read in growbuf_to_str() at w3m/indep.c

Medium 4.7

In plain English

A medium-severity out-of-bounds read in Extra Packages for Enterprise Linux from Fedora. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.7Medium
Exploit odds (30 days)0.4%top 70.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

An out-of-bounds read flaw was found in w3m, in the growbuf_to_Str function in indep.c. This issue may allow an attacker to cause a denial of service through a crafted HTML file.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20w3m0.5.3.20230718-r0ALPINE-CVE-2023-38253
Alpine:v3.21w3m0.5.3.20230718-r0ALPINE-CVE-2023-38253
Alpine:v3.22w3m0.5.3_git20241203-r0ALPINE-CVE-2023-38253
Alpine:v3.23w3m0.5.3_git20241203-r0ALPINE-CVE-2023-38253
Alpine:v3.24w3m0.5.3_git20241203-r0ALPINE-CVE-2023-38253
Debian:12w3mno fix listedDEBIAN-CVE-2023-38253
Debian:13w3mno fix listedDEBIAN-CVE-2023-38253
Debian:14w3mno fix listedDEBIAN-CVE-2023-38253
Ubuntu:22.04:LTSw3m0.5.3+git20210102-6ubuntu0.2UBUNTU-CVE-2023-38253
Ubuntu:24.04:LTSw3m0.5.3+git20230121-2ubuntu1UBUNTU-CVE-2023-38253

Affected products (as reported)

VendorProductVersions
n/a w3m see references
Red Hat Red Hat Enterprise Linux 6 see references
Fedora Extra Packages for Enterprise Linux see references
Fedora Fedora see references

Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

References