CVE-2016-9435

Published: Jan 20, 2017Modified: May 13, 2026

6.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

The HTMLtagproc1 function in file.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application via a crafted html file, related to <dd> tags.

Affected (3)

Products: Opensuse: Leap · Opensuse Project: Leap · Tats: W3m

1 product

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 42.2
Opensuse Project Leap	Version 42.1

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Tats W3m	Up to 0.5.3\+git20160718

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (12)

http://lists.opensuse.org/opensuse-updates/2016-12/msg00084.html

Source: cve@mitre.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2016/11/18/3

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

http://www.securityfocus.com/bid/94407

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://github.com/tats/w3m/commit/33509cc81ec5f2ba44eb6fd98bd5c1b5873e46bd

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://github.com/tats/w3m/issues/16

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://security.gentoo.org/glsa/201701-08

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://lists.opensuse.org/opensuse-updates/2016-12/msg00084.html