Bug 235412 - CVE-2007-2027 elinks tries to load .po files from a non-absolute path
Summary: CVE-2007-2027 elinks tries to load .po files from a non-absolute path
Alias: None
Product: Fedora
Classification: Fedora
Component: elinks   
(Show other bugs)
Version: 6
Hardware: All Linux
Target Milestone: ---
Assignee: Karel Zak
QA Contact:
URL: http://bugs.debian.org/cgi-bin/bugrep...
Whiteboard: impact=low,source=debian,reported=200...
Keywords: Security
Depends On: CVE-2007-2027
TreeView+ depends on / blocked
Reported: 2007-04-05 16:30 UTC by Lubomir Kundrak
Modified: 2007-11-30 22:12 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2007-06-04 11:44:27 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

Description Lubomir Kundrak 2007-04-05 16:30:24 UTC
+++ This bug was initially created as a clone of Bug #235411 +++

Description of problem:

Arnaud Giersch discovered that the following chunk of code from
src/intl/gettext/loadmsgcat.c:add_filename_to_string() causes elinks
to read .po files fro man untrusted location.

215         if ((dirnamelen && !add_bytes_to_string(str, program.path, dirnamelen))
216             || !add_to_string(str, "../po/")
217             || !add_bytes_to_string(str,

An untrusted message catalog might lead to a format-string attack when an
attacker tricks user into launching links from a particular directory.

Version-Release number of selected component (if applicable):

        Doesn't Affect: RHEL3
        Affects: RHEL4
        Affects: RHEL5
        Affects: FC5
        Affects: FC6

Additional info:

It is questionable who would launch elinks from a directory controlled
by someone else and thus whether this is exploitable in real world.

Comment 1 Karel Zak 2007-05-31 07:13:04 UTC
Fixed. Update to elinks-0.11.1-5.2.

Note You need to log in before you can comment on or make changes to this bug.