Debian Security Advisory DSA 874-1

Package : lynx
Vulnerability : buffer overflow
Problem type : remote
Debian-specific: no
CVE ID : CVE-2005-3120


Ulf Härnhammar discovered a buffer overflow in lynx, a text-mode browser for the WWW that can be remotely exploited. During the handling of Asian characters when connecting to an NNTP server lynx can be tricked to write past the boundary of a buffer which can lead to the execution of arbitrary code.



For the old stable distribution (woody) this problem has been fixed in version 2.8.4.1b-3.3.



For the stable distribution (sarge) this problem has been fixed in version 2.8.5-2sarge1.



For the unstable distribution (sid) this problem will be fixed soon.



We recommend that you upgrade your lynx package.



Upgrade Instructions



wget url



will fetch the file for you
dpkg -i file.deb


will install the referenced file.



If you are using the apt-get package manager, use the line for sources.list as given below:



apt-get update



will update the internal database apt-get upgrade



will install corrected packages



You may use an automated update by adding the resources from the footer to the proper configuration.



Debian GNU/Linux 3.0 alias woody

Full Story