Bug 235412 - CVE-2007-2027 elinks tries to load .po files from a non-absolute path
CVE-2007-2027 elinks tries to load .po files from a non-absolute path
Product: Fedora
Classification: Fedora
Component: elinks (Show other bugs)
All Linux
low Severity low
: ---
: ---
Assigned To: Karel Zak
: Security
Depends On: CVE-2007-2027
  Show dependency treegraph
Reported: 2007-04-05 12:30 EDT by Lubomir Kundrak
Modified: 2007-11-30 17:12 EST (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2007-06-04 07:44:27 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Lubomir Kundrak 2007-04-05 12:30:24 EDT
+++ This bug was initially created as a clone of Bug #235411 +++

Description of problem:

Arnaud Giersch discovered that the following chunk of code from
src/intl/gettext/loadmsgcat.c:add_filename_to_string() causes elinks
to read .po files fro man untrusted location.

215         if ((dirnamelen && !add_bytes_to_string(str, program.path, dirnamelen))
216             || !add_to_string(str, "../po/")
217             || !add_bytes_to_string(str,

An untrusted message catalog might lead to a format-string attack when an
attacker tricks user into launching links from a particular directory.

Version-Release number of selected component (if applicable):

        Doesn't Affect: RHEL3
        Affects: RHEL4
        Affects: RHEL5
        Affects: FC5
        Affects: FC6

Additional info:

It is questionable who would launch elinks from a directory controlled
by someone else and thus whether this is exploitable in real world.
Comment 1 Karel Zak 2007-05-31 03:13:04 EDT
Fixed. Update to elinks-0.11.1-5.2.

Note You need to log in before you can comment on or make changes to this bug.