full-disclosure - [ MDVSA-2008:218 ] lynx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1KuvnE-0007SV-62@titan.mandriva.com>
Date: Tue, 28 Oct 2008 15:08:00 -0600
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2008:218 ] lynx


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2008:218
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : lynx
 Date    : October 28, 2008
 Affected: 2008.0, 2008.1, 2009.0
 _______________________________________________________________________

 Problem Description:

 A vulnerability was found in the Lynxcgi: URI handler that could allow
 an attacker to create a web page redirecting to a malicious URL that
 would execute arbitrary code as the user running Lynx, if they were
 using the non-default Advanced user mode (CVE-2008-4690).
 
 This update corrects these issues and, in addition, makes Lynx always
 prompt the user before loading a lynxcgi: URI.  As well, the default
 lynx.cfg configuration file marks all lynxcgi: URIs as untrusted.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4690
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2008.0:
 2a6a4130c12d3d45d926b49713420272  2008.0/i586/lynx-2.8.6-2.1mdv2008.0.i586.rpm 
 aa0ff44a80fa5b485b54f52d12b485f2  2008.0/SRPMS/lynx-2.8.6-2.1mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64:
 dcabb93ba8e48a0a96a632d2c8b11cb4  2008.0/x86_64/lynx-2.8.6-2.1mdv2008.0.x86_64.rpm 
 aa0ff44a80fa5b485b54f52d12b485f2  2008.0/SRPMS/lynx-2.8.6-2.1mdv2008.0.src.rpm

 Mandriva Linux 2008.1:
 1e04683750a061eecbe58c1b4fe7b173  2008.1/i586/lynx-2.8.6-2.1mdv2008.1.i586.rpm 
 68ddd2a1b9f991c11793a51dfbe9d9cb  2008.1/SRPMS/lynx-2.8.6-2.1mdv2008.1.src.rpm

 Mandriva Linux 2008.1/X86_64:
 3ae02ae07a01e65aa16e3317e2d7afb0  2008.1/x86_64/lynx-2.8.6-2.1mdv2008.1.x86_64.rpm 
 68ddd2a1b9f991c11793a51dfbe9d9cb  2008.1/SRPMS/lynx-2.8.6-2.1mdv2008.1.src.rpm

 Mandriva Linux 2009.0:
 65c1c0a4cf6a8758bc8506b9a7b1d3c4  2009.0/i586/lynx-2.8.6-2.1mdv2009.0.i586.rpm 
 0026bfc6799a2242afd794932ce0b5a8  2009.0/SRPMS/lynx-2.8.6-2.1mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 0ad22b9ff40e6c7b8fc8ce25c4ef51cc  2009.0/x86_64/lynx-2.8.6-2.1mdv2009.0.x86_64.rpm 
 0026bfc6799a2242afd794932ce0b5a8  2009.0/SRPMS/lynx-2.8.6-2.1mdv2009.0.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFJB1LHmqjQ0CJFipgRAqQNAJwJ7ePHFR/FopDId6tWFKhc0kLHPQCeKF/e
r+RQJ0K1ymIZKh/t9S9NxI4=
=gays
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/