Bug 235412

Summary:	CVE-2007-2027 elinks tries to load .po files from a non-absolute path
Product:	[Fedora] Fedora	Reporter:	Lubomir Kundrak <lkundrak>
Component:	elinks	Assignee:	Karel Zak <kzak>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	6	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=417789
Whiteboard:	impact=low,source=debian,reported=20070405,public=20070404
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2007-06-04 11:44:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	235411
Bug Blocks:

Description Lubomir Kundrak 2007-04-05 16:30:24 UTC

+++ This bug was initially created as a clone of Bug #235411 +++

Description of problem:

Arnaud Giersch discovered that the following chunk of code from
src/intl/gettext/loadmsgcat.c:add_filename_to_string() causes elinks
to read .po files fro man untrusted location.

215         if ((dirnamelen && !add_bytes_to_string(str, program.path, dirnamelen))
216             || !add_to_string(str, "../po/")
217             || !add_bytes_to_string(str,

An untrusted message catalog might lead to a format-string attack when an
attacker tricks user into launching links from a particular directory.

Version-Release number of selected component (if applicable):

        Doesn't Affect: RHEL3
        Affects: RHEL4
        Affects: RHEL5
        Affects: FC5
        Affects: FC6

Additional info:

It is questionable who would launch elinks from a directory controlled
by someone else and thus whether this is exploitable in real world.

Comment 1 Karel Zak 2007-05-31 07:13:04 UTC

Fixed. Update to elinks-0.11.1-5.2.