Advisories » MGASA-2017-0451

Updated lynx package fixes security vulnerability

Publication date: 16 Dec 2017
Modification date: 16 Dec 2017
Type: security
Affected Mageia releases : 5 , 6
CVE: CVE-2017-1000211

Description

Lynx before 2.8.9dev.16 is vulnerable to a use after free in the HTML
parser resulting in memory disclosure, because HTML_put_string() can
append a chunk onto itself. (CVE-2017-1000211)
                

References

• https://bugs.mageia.org/show_bug.cgi?id=22132
• https://lists.opensuse.org/opensuse-updates/2017-12/msg00007.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000211

SRPMS

6/core

• lynx-2.8.8-1.rel2.6.1.mga6

5/core

• lynx-2.8.8-1.rel2.3.2.mga5