FS#22346 - [w3m] does not properly handle a '\0' character

Attached to Project: Arch Linux
Opened by Greg (dolby) - Friday, 07 January 2011, 09:40 GMT
Last edited by Gaetan Bisson (vesath) - Saturday, 15 January 2011, 11:53 GMT
Task Type Bug Report
Category Security
Status Closed
Assigned To Gaetan Bisson (vesath)
Architecture All
Severity High
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

w3m doesn't verify certificates by default ('ssl_verify_server' is off by default). Theres two patches in [1] that turn on 'ssl_verify_server' and fix the null handling.

This has been fixed in the upstream CVS [2]
CVE report just for reference [3]

[1]: http://www.openwall.com/lists/oss-security/2010/06/14/4
[2]: http://w3m.cvs.sourceforge.net/viewvc/w3m/w3m/ChangeLog?revision=1.1049&view=markup (loads the whole ChangeLog)
[3]: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2408
This task depends upon

Closed by  Gaetan Bisson (vesath)
Saturday, 15 January 2011, 11:53 GMT
Reason for closing:  Fixed
Additional comments about closing:  upstream has answered our prayers: 0.5.3-1 is in [extra].
Comment by Gaetan Bisson (vesath) - Friday, 07 January 2011, 11:07 GMT
I would prefer to release a brand new version of w3m rather than backport one-by-one the improvements that have been made to the upstream CVS since the last release in May 2007.
I have posted to their ML asking if they have future release plans; if they don't, I could be tempted to just package the CVS version...
Comment by Greg (dolby) - Friday, 07 January 2011, 11:33 GMT
Sorry, the wording of the report is awful since i just copied the email in [1]. Apologies.
My main concern is patching for the security issue.
The patch for istream.c in http://www.openwall.com/lists/oss-security/2010/06/14/4 does that.
Comment by Gaetan Bisson (vesath) - Friday, 07 January 2011, 12:17 GMT
I understand.
But rather than fixing just this specific issue by adding a patch, I would prefer to fix all issues that have been fixed in the CVS since May 2007 by upgrading w3m to a new release or the CVS head. Of course, if I don't do that in the near future, I will add the patch...
Comment by Greg (dolby) - Tuesday, 11 January 2011, 17:27 GMT
While we are at it could you add some documentation to the package as well?
Its annoying not having any especially the MANUAL.html and *definitely* the keymap.* and the menu.* ones.
Those things arent available online, you have to dig into the source to find em. Thanks.
Comment by Gaetan Bisson (vesath) - Wednesday, 12 January 2011, 13:21 GMT
If I haven't heard back from the w3m devs regarding possible release plans by next week, I'll switch to the w3m package there: http://arch.vesath.org/all/
It uses a CVS snapshot and includes the doc.

Loading...