[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20081027183819.GA10180@sdf.lonestar.org>
Date: Mon, 27 Oct 2008 18:38:19 +0000
From: Tavis Ormandy <taviso@....lonestar.org>
To: oss-security@...ts.openwall.com
Cc: coley@...re.org
Subject: Re: CVE request: lynx (old) .mailcap handling flaw
On Sat, Oct 25, 2008 at 08:27:51PM +0200, Tomas Hoger wrote:
> Hi Steven!
>
> There's one old lynx issue that seem to need a 2006 CVE id. lynx
> browser prior to 2.8.6rel.4 tries to open mailcap and mime type
> definition files form the current directory. If user can be convinced
> to run lynx in a specially crafted directory, an attacker controlling
> the directory may be able to run arbitrary code as the victim running
> lynx.
That reminds me, I recently noticed valgrind also does this.
$ printf -- "--db-command=/usr/bin/id\n--db-attach=yes\n" > /tmp/.valgrindrc
Etc.
Thanks, Tavis.
--
-------------------------------------
taviso@....lonestar.org | finger me for my gpg key.
-------------------------------------------------------
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
