Description
Format string vulnerability in the inputAnswer function in file.c in w3m before 0.5.2, when run with the dump or backend option, allows remote attackers to execute arbitrary code via format string specifiers in the Common Name (CN) field of an SSL certificate associated with an https URL.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | w3m | 0.5.1-5.1 | — |
| Debian 13 | w3m | 0.5.1-5.1 | — |
| Debian 12 | w3m | 0.5.1-5.1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | w3m | 0.5.3+git20180125-1.14 | openSUSE-SU-2024:11504-1 |
Advisories 1
- openSUSE-SU-2024:11504-1 w3m-0.5.3+git20180125-1.14 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://w3m.cvs.sourceforge.net/w3m/w3m/file.c?view=log
- FEDORA-2007-077 vendor-advisory
- 20061225 w3m format string bug mailing-list
- ADV-2006-5164 vdb-entry
- OpenPKG-SA-2006.44 vendor-advisory
- http://w3m.cvs.sourceforge.net/w3m/w3m/file.c?r1=1.249&r2=1.250
- w3m-certificate-format-string(31114) vdb-entry
- 23717 third-party-advisory
- GLSA-200701-06 vendor-advisory
- 23492 third-party-advisory
- 23792 third-party-advisory
- http://w3m.cvs.sourceforge.net/%2Acheckout%2A/w3m/w3m/NEWS?revision=1.79
- 1017440 vdb-entry
- w3m-inputanswer-format-string(34821) vdb-entry
- http://sourceforge.net/tracker/index.php?func=detail&aid=1612792&group_id=39518&atid=425439
- SUSE-SA:2007:005 vendor-advisory
- 21735 vdb-entry
- 24332 vdb-entry
- USN-399-1 vendor-advisory
- 23773 third-party-advisory
- 23588 third-party-advisory
- FEDORA-2007-078 vendor-advisory