Hi, The following vulnerability was published for w3m. CVE-2023-4255[0]: | An out-of-bounds write issue has been discovered in the backspace | handling of the checkType() function in etc.c within the W3M | application. This vulnerability is triggered by supplying a | specially crafted HTML file to the w3m binary. Exploitation of this | flaw could lead to application crashes, resulting in a denial of | service condition. https://github.com/tats/w3m/commit/edc602651c506aeeb60544b55534dd1722a340d3 https://github.com/tats/w3m/issues/268 https://github.com/tats/w3m/pull/273 If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2023-4255 https://www.cve.org/CVERecord?id=CVE-2023-4255 Please adjust the affected versions in the BTS as needed.
Dear maintainer,
I've prepared an NMU for w3m (versioned as 0.5.3+git20230121-2.1). The diff
is attached to this message.
Regards.
diff -Nru w3m-0.5.3+git20230121/debian/changelog
w3m-0.5.3+git20230121/debian/changelog
--- w3m-0.5.3+git20230121/debian/changelog 2023-01-29 12:03:49.000000000
+0000
+++ w3m-0.5.3+git20230121/debian/changelog 2025-01-03 07:36:38.000000000
+0000
@@ -1,3 +1,11 @@
+w3m (0.5.3+git20230121-2.1) unstable; urgency=medium
+
+ * Non-maintainer upload.
+ * Cherry-pick patch from upstream to fix a security bug.
+ (Closes: #1059265, CVE-2023-4255)
+
+ -- Niels Thykier <niels@thykier.net> Fri, 03 Jan 2025 07:36:38 +0000
+
w3m (0.5.3+git20230121-2) unstable; urgency=medium
* Update German message catalogue (closes: #1029933)
diff -Nru w3m-0.5.3+git20230121/debian/patches/0002-CVE-2023-4255.patch
w3m-0.5.3+git20230121/debian/patches/0002-CVE-2023-4255.patch
--- w3m-0.5.3+git20230121/debian/patches/0002-CVE-2023-4255.patch
1970-01-01 00:00:00.000000000 +0000
+++ w3m-0.5.3+git20230121/debian/patches/0002-CVE-2023-4255.patch
2025-01-03 07:33:54.000000000 +0000
@@ -0,0 +1,55 @@
+From edc602651c506aeeb60544b55534dd1722a340d3 Mon Sep 17 00:00:00 2001
+From: Rene Kita <mail@rkta.de>
+Date: Thu, 13 Jul 2023 07:50:26 +0200
+Subject: [PATCH] Fix OOB access due to multiple backspaces
+
+Commit 419ca82d57 (Fix m17n backspace handling causes out-of-bounds
+write in checkType) introduced an incomplete fix.
+
+In function checkType we store the length of the previous multi-char
+character in a buffer plens_buffer with pointer plens pointing to the
+current position inside the buffer. When encountering a backspace plens
+is set to the previous position without a bounds check. This will lead
+to plens being out of bounds if we get more backspaces than we have
+processed multi-char characters before.
+
+If we are at the beginning of the buffer do not decrement and set plen
+(the current length) to 0.
+
+This also fixes GH Issue #270 [BUG] Out of bound read in Strnew_size ,
+Str.c:61
+
+If the above explanation does sound weird it's because I didn't fully
+grok that function. :-)
+---
+ etc.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/etc.c b/etc.c
+index 128717b18..b56615136 100644
+--- a/etc.c
++++ b/etc.c
+@@ -393,7 +393,10 @@ checkType(Str s, Lineprop **oprop, Linecolor **ocolor)
+ if (color)
+ color -= plen;
+ #endif
+- plen = *(--plens);
++ if (plens == plens_buffer)
++ plen = 0;
++ else
++ plen = *(--plens);
+ str += 2;
+ }
+ }
+@@ -419,7 +422,10 @@ checkType(Str s, Lineprop **oprop, Linecolor **ocolor)
+ if (color)
+ color -= plen;
+ #endif
+- plen = *(--plens);
++ if (plens == plens_buffer)
++ plen = 0;
++ else
++ plen = *(--plens);
+ str++;
+ }
+ #else
diff -Nru w3m-0.5.3+git20230121/debian/patches/series
w3m-0.5.3+git20230121/debian/patches/series
--- w3m-0.5.3+git20230121/debian/patches/series 2023-01-29
11:46:01.000000000 +0000
+++ w3m-0.5.3+git20230121/debian/patches/series 2025-01-03
07:34:05.000000000 +0000
@@ -1 +1,2 @@
0001-Update-German-message-catalogue.patch
+0002-CVE-2023-4255.patch
We believe that the bug you reported is fixed in the latest version of
w3m, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1059265@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Niels Thykier <niels@thykier.net> (supplier of updated w3m package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 03 Jan 2025 07:36:38 +0000
Source: w3m
Architecture: source
Version: 0.5.3+git20230121-2.1
Distribution: unstable
Urgency: medium
Maintainer: Tatsuya Kinoshita <tats@debian.org>
Changed-By: Niels Thykier <niels@thykier.net>
Closes: 1059265
Changes:
w3m (0.5.3+git20230121-2.1) unstable; urgency=medium
.
* Non-maintainer upload.
* Cherry-pick patch from upstream to fix a security bug.
(Closes: #1059265, CVE-2023-4255)
Checksums-Sha1:
2b9563cb7edbf51a68d00ab2756df90f81e985bb 1767 w3m_0.5.3+git20230121-2.1.dsc
77e823aa0218b08d3481a7867d78c42539d65636 28268 w3m_0.5.3+git20230121-2.1.debian.tar.xz
4164ef40d381011ab9d7e88dacc4564cf87e6309 12014 w3m_0.5.3+git20230121-2.1_source.buildinfo
Checksums-Sha256:
56aeb1dd7549d13b76022681dc036d0bb043bf44a8a94c9436d4baa458b4d816 1767 w3m_0.5.3+git20230121-2.1.dsc
b186829d6f1b8813dae0e3510a9e7256ba0a039309b603b8522f86119bde5437 28268 w3m_0.5.3+git20230121-2.1.debian.tar.xz
bceac4a5a6ce05f4adddafdf258c1cc209471fa6800b738309108a6fe4d51bb6 12014 w3m_0.5.3+git20230121-2.1_source.buildinfo
Files:
4757a90fc47ee90aa70cdbefaf368be0 1767 web optional w3m_0.5.3+git20230121-2.1.dsc
d967231b8d994ba2664eb9324eccc959 28268 web optional w3m_0.5.3+git20230121-2.1.debian.tar.xz
7f583acf7944ff2d6c9c8b80786005de 12014 web optional w3m_0.5.3+git20230121-2.1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQFGBAEBCgAwFiEE9ecZmu9eXGflVYc/dA1oiINl0okFAmd3k9ESHG5pZWxzQHRo
eWtpZXIubmV0AAoJEHQNaIiDZdKJcHUIAIbwHZr9HQ+slazB0LgzLu7VqzUlgCuC
w/zSdo8vJBVcCDrhpC5Tan35vh/HqRr7YgSr9F/4/Z5j6VeVqWVtSU8vjaYjF0U+
vscxD9rgWAN11n/8sm4+UIh59WK3HFtyO9WTXRJMUHb0UrUCisI4k2gN1Z3LcNQ/
ZCreT0FyLtK1IWFTYhWmOn/Ob7RuAwoC0tlVg57omuN8d5h/PYGqB4Y0s+CPCV5k
gFK/fufTmV3r9u5W4FGB73ObupYEQpPFcVQAWB9u/7KDVuLqmV93nhm7IFLKYOjR
fnoqElf9sEzQsa+RHDEXBlpo/nIKKZ4jxG//wFWC1eq3/2/U+G+/qcY=
=Anv4
-----END PGP SIGNATURE-----