Lucene search

Gentoo FoundationGLSA-201210-01

HistoryOct 18, 2012 - 12:00 a.m.

w3m: SSL spoofing vulnerability

2012-10-1800:00:00

Gentoo Foundation

security.gentoo.org

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

0.004

Percentile

74.3%

JSON

Background

w3m is a text based WWW browser.

Description

A SSL spoofing vulnerability has been discovered in w3m. Please review the CVE identifier referenced below for details.

Impact

A remote attacker might employ a specially crafted certificate to conduct man-in-the-middle attacks on SSL connections made using w3m.

Workaround

There is no known workaround at this time.

Resolution

All w3m users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose "&gt;=www-client/w3m-0.5.2-r4"

OSVersionArchitecturePackageVersionFilename
Gentooanyallwww-client/w3m< 0.5.2-r4UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Gentoo	any	all	www-client/w3m	< 0.5.2-r4	UNKNOWN

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

0.004

Percentile

74.3%

JSON

Related for GLSA-201210-01