Bug 1539127 (CVE-2018-6198)

Summary: CVE-2018-6198 w3m: insecure temporary files creation when ~/.w3m is unwritable
Product: [Other] Security Response Reporter: Pedro Sampaio <psampaio>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NEXTRELEASE QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: eng-i18n-bugs, pnemade, redhat-bugzilla
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=low,public=20180123,reported=20180123,source=debian,cvss3=4.3/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N,cwe=CWE-377,fedora-all/w3m=affected,epel-7/w3m=affected,rhel-5/w3m=wontfix,rhel-6/w3m=wontfix,rhel-8/w3m=notaffected
Fixed In Version: w3m 0.5.3+git20180125 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-06-24 08:48:44 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 1539128, 1539129, 1539130    
Bug Blocks:    

Description Pedro Sampaio 2018-01-26 18:16:23 UTC
A flaw was found in w3m 0.5.3-34. When ~/.w3m is unwritable, w3m uses /tmp in an insecure fashion, which allows a local attacker to craft a symlink attack to overwrite arbitrary files.

Upstream patch:

https://github.com/tats/w3m/commit/18dcbadf2771cdb0c18509b14e4e73505b242753

Comment 1 Pedro Sampaio 2018-01-26 18:16:43 UTC
Created w3m tracking bugs for this issue:

Affects: epel-7 [bug 1539130]
Affects: fedora-all [bug 1539129]

Comment 3 Parag Nemade 2018-06-24 08:48:44 UTC
Fixed for all the requested releases.