Security bugs are reported here via bugzilla

[Thomas Houssin <thomas.houssin AT gmail.com>]

Synopsis
========
A stack-based buffer overflow was reported in the HTrjis function in lynx.

Background
==========
Lynx is a fully-featured World Wide Web (WWW) client for users running
cursor-addressable, character-cell display devices (e.g., vt100
terminals, vt100 emulators running on PCs or Macs, or any other
character-cell display).

Description
===========
CAN-2005-3120:
Stack-based buffer overflow in the HTrjis function in lynx allows remote
NNTP servers to execute arbitrary code via certain article headers
containing Asian characters that cause Lynx to add extra escape (ESC)
characters.

Impact
======
An attacker could setup a malicious NNTP server and entice a user to
access it using Lynx (for example by creating NNTP links on a web page).
The data returned by the NNTP server would trigger the buffer overflow
and execute arbitrary code with the rights of the user running Lynx.

Workaround
==========
There are no known workarounds at this time.

Affected packages
=================
This is now fixed in all grimoires.

Resolution
==========
All lynx users should upgrade to the latest available version:
         # scribe update
         # cast -c lynx

References
==========
   [ 1 ] CAN-2005-3120
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3120
   [ 2 ] GLSA 200510-15
         http://www.gentoo.org/security/en/glsa/glsa-200510-15.xml

-- 
Thomas Houssin

Security Team Leader Source Mage GNU/Linux (http://www.sourcemage.org)
Key fingerprint = 3CB8 3FC4 840D B272 E623  BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36

Attachment: signature.asc
Description: OpenPGP digital signature