Skip to content
OpenAdvisories
Unscored USN-4800-1 3 CVEs

lynx vulnerabilities

Published Mar 15, 2021 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Lynx incorrectly handled certain URLs. A remote attacker
could possibly use this issue to obtain sensitive information or other
unspecified impact. This issue only affected Ubuntu 16.04 ESM.
(CVE-2016-9179)

It was discovered that Lynx incorrectly handled certain HTML files. A remote
attacker could possibly use this issue to obtain sensitive information.
This issue only affected Ubuntu 16.04 ESM. (CVE-2017-1000211)

Thorsten Glaser discovered that Lynx mishandles the userinfo subcomponents of
a URI. An attacker monitoring the network could discover cleartext
credentials because they may appear in SNI data. (CVE-2021-38165)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS lynx 2.8.9dev8-4ubuntu1+esm2
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS lynx 2.8.9dev16-3ubuntu0.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS lynx 2.9.0dev.5-1ubuntu0.1~esm1

Vulnerabilities 3

  • Unscored —
    CVE-2016-9179

    lynx: It was found that Lynx doesn't parse the authority component of the URL correctly when the host name part ends wi…

    lynx lynx Debian Ubuntu
  • Unscored —
    CVE-2017-1000211

    Lynx before 2.8.9dev.16 is vulnerable to a use after free in the HTML parser resulting in memory disclosure, because HT…

    lynx lynx Debian Ubuntu
  • Unscored —
    CVE-2021-38165

    Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext c…

    lynx lynx lynx Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2016-9179
  • report
    https://ubuntu.com/security/CVE-2017-1000211
  • report
    https://ubuntu.com/security/CVE-2021-38165