Opened 19 years ago
Closed 18 years ago
#1678 closed defect (fixed)
Lynx-2.8.5 Vulnerability
| Reported by: | Owned by: | Randy McMurchy | |
|---|---|---|---|
| Priority: | highest | Milestone: | 6.2.0 |
| Component: | BOOK | Version: | SVN |
| Severity: | normal | Keywords: | |
| Cc: |
Description
The link has the info. Upstream hasn't made a security release.
Change History (6)
comment:1 by , 18 years ago
comment:2 by , 18 years ago
| bug_file_loc: | http://frontal1.mandriva.com/security/advisories?name=MDKSA-2005:186-1 → http://seclists.org/lists/vulnwatch/2005/Oct-Dec/0041.html |
|---|---|
| Milestone: | future → 6.2 |
| op_sys: | All → Linux |
| Owner: | changed from to |
| Priority: | high → highest |
Updated the link to the security advisory.
It appears the easiest way to address this issue until a new version of Lynx is released is to follow the instructions in the adivsory and install the following directive in the lynx.cfg file: TRUSTED_LYNXCGI:none
This seems easier than using the 15 level revision patch of the development version of Lynx.
comment:3 by , 18 years ago
| Status: | new → assigned |
|---|
comment:4 by , 18 years ago
Looking at this issue further (hoping that the original security vulnerability was the one I pointed the new link to), I don't think the issue affects BLFS as we don't enable the 'lynxcgi' feature by default.
As is mentioned in the security bulletin, you must explicitly compile lynxcgi support into the build using the --enable-lynxcgi-links switch, which BLFS does not by default.
I think simply mentioning this switch in the "command explanations" section with a note to not use it because of the security vulnerability is enough to close the bug.
I'll wait for Archaic to comment and/or close the bug after I update Lynx.
comment:5 by , 18 years ago
Added a note to the Lynx instructions that identifies, and shows how to avoid this security vulnerability.
I believe the bug is ready to close, however I'll wait for Archaic to comment and/or close it.
It appears the link provided to review the security vulnerability is password protected. Anybody have any idea if these advisories are located elsewhere?
I'm going to do some googling in the meantime.