CVE-2006-6772

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2006-12-10T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Format string vulnerability in the inputAnswer function in file.c in w3m before 0.5.2, when run with the dump or backend option, allows remote attackers to execute arbitrary code via format string specifiers in the Common Name (CN) field of an SSL certificate associated with an https URL."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-28T12:57:01.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://w3m.cvs.sourceforge.net/w3m/w3m/file.c?view=log"}, {"name": "FEDORA-2007-077", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "http://fedoranews.org/cms/node/2415"}, {"name": "20061225 w3m format string bug", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051457.html"}, {"name": "ADV-2006-5164", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2006/5164"}, {"name": "OpenPKG-SA-2006.44", "tags": ["vendor-advisory", "x_refsource_OPENPKG"], "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2006.044.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://w3m.cvs.sourceforge.net/w3m/w3m/file.c?r1=1.249&r2=1.250"}, {"name": "w3m-certificate-format-string(31114)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31114"}, {"name": "23717", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/23717"}, {"name": "GLSA-200701-06", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "http://security.gentoo.org/glsa/glsa-200701-06.xml"}, {"name": "23492", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/23492"}, {"name": "23792", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/23792"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://w3m.cvs.sourceforge.net/%2Acheckout%2A/w3m/w3m/NEWS?revision=1.79"}, {"name": "1017440", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://securitytracker.com/id?1017440"}, {"name": "w3m-inputanswer-format-string(34821)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34821"}, {"tags": ["x_refsource_MISC"], "url": "http://sourceforge.net/tracker/index.php?func=detail&aid=1612792&group_id=39518&atid=425439"}, {"name": "SUSE-SA:2007:005", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://www.novell.com/linux/security/advisories/2007_05_w3m.html"}, {"name": "21735", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/21735"}, {"name": "24332", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/24332"}, {"name": "USN-399-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/usn-399-1"}, {"name": "23773", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/23773"}, {"name": "23588", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/23588"}, {"name": "FEDORA-2007-078", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "http://fedoranews.org/cms/node/2416"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2006-6772", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Format string vulnerability in the inputAnswer function in file.c in w3m before 0.5.2, when run with the dump or backend option, allows remote attackers to execute arbitrary code via format string specifiers in the Common Name (CN) field of an SSL certificate associated with an https URL."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://w3m.cvs.sourceforge.net/w3m/w3m/file.c?view=log", "refsource": "CONFIRM", "url": "http://w3m.cvs.sourceforge.net/w3m/w3m/file.c?view=log"}, {"name": "FEDORA-2007-077", "refsource": "FEDORA", "url": "http://fedoranews.org/cms/node/2415"}, {"name": "20061225 w3m format string bug", "refsource": "FULLDISC", "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051457.html"}, {"name": "ADV-2006-5164", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2006/5164"}, {"name": "OpenPKG-SA-2006.44", "refsource": "OPENPKG", "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2006.044.html"}, {"name": "http://w3m.cvs.sourceforge.net/w3m/w3m/file.c?r1=1.249&r2=1.250", "refsource": "CONFIRM", "url": "http://w3m.cvs.sourceforge.net/w3m/w3m/file.c?r1=1.249&r2=1.250"}, {"name": "w3m-certificate-format-string(31114)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31114"}, {"name": "23717", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/23717"}, {"name": "GLSA-200701-06", "refsource": "GENTOO", "url": "http://security.gentoo.org/glsa/glsa-200701-06.xml"}, {"name": "23492", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/23492"}, {"name": "23792", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/23792"}, {"name": "http://w3m.cvs.sourceforge.net/*checkout*/w3m/w3m/NEWS?revision=1.79", "refsource": "CONFIRM", "url": "http://w3m.cvs.sourceforge.net/*checkout*/w3m/w3m/NEWS?revision=1.79"}, {"name": "1017440", "refsource": "SECTRACK", "url": "http://securitytracker.com/id?1017440"}, {"name": "w3m-inputanswer-format-string(34821)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34821"}, {"name": "http://sourceforge.net/tracker/index.php?func=detail&aid=1612792&group_id=39518&atid=425439", "refsource": "MISC", "url": "http://sourceforge.net/tracker/index.php?func=detail&aid=1612792&group_id=39518&atid=425439"}, {"name": "SUSE-SA:2007:005", "refsource": "SUSE", "url": "http://www.novell.com/linux/security/advisories/2007_05_w3m.html"}, {"name": "21735", "refsource": "BID", "url": "http://www.securityfocus.com/bid/21735"}, {"name": "24332", "refsource": "BID", "url": "http://www.securityfocus.com/bid/24332"}, {"name": "USN-399-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/usn-399-1"}, {"name": "23773", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/23773"}, {"name": "23588", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/23588"}, {"name": "FEDORA-2007-078", "refsource": "FEDORA", "url": "http://fedoranews.org/cms/node/2416"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T20:42:06.528Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://w3m.cvs.sourceforge.net/w3m/w3m/file.c?view=log"}, {"name": "FEDORA-2007-077", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "http://fedoranews.org/cms/node/2415"}, {"name": "20061225 w3m format string bug", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051457.html"}, {"name": "ADV-2006-5164", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2006/5164"}, {"name": "OpenPKG-SA-2006.44", "tags": ["vendor-advisory", "x_refsource_OPENPKG", "x_transferred"], "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2006.044.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://w3m.cvs.sourceforge.net/w3m/w3m/file.c?r1=1.249&r2=1.250"}, {"name": "w3m-certificate-format-string(31114)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31114"}, {"name": "23717", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/23717"}, {"name": "GLSA-200701-06", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "http://security.gentoo.org/glsa/glsa-200701-06.xml"}, {"name": "23492", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/23492"}, {"name": "23792", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/23792"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://w3m.cvs.sourceforge.net/%2Acheckout%2A/w3m/w3m/NEWS?revision=1.79"}, {"name": "1017440", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://securitytracker.com/id?1017440"}, {"name": "w3m-inputanswer-format-string(34821)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34821"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://sourceforge.net/tracker/index.php?func=detail&aid=1612792&group_id=39518&atid=425439"}, {"name": "SUSE-SA:2007:005", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://www.novell.com/linux/security/advisories/2007_05_w3m.html"}, {"name": "21735", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/21735"}, {"name": "24332", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/24332"}, {"name": "USN-399-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "http://www.ubuntu.com/usn/usn-399-1"}, {"name": "23773", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/23773"}, {"name": "23588", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/23588"}, {"name": "FEDORA-2007-078", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "http://fedoranews.org/cms/node/2416"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2006-6772", "datePublished": "2006-12-27T23:00:00.000Z", "dateReserved": "2006-12-27T00:00:00.000Z", "dateUpdated": "2024-08-07T20:42:06.528Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:w3m:w3m:0.5.1:*:*:*:*:*:*:*", "matchCriteriaId": "8F48F335-F985-4C9F-BF31-EBBA881C5F1C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Format string vulnerability in the inputAnswer function in file.c in w3m before 0.5.2, when run with the dump or backend option, allows remote attackers to execute arbitrary code via format string specifiers in the Common Name (CN) field of an SSL certificate associated with an https URL."}, {"lang": "es", "value": "Vulnerabilidad de cadena de formato en la funci\u00f3n inputAnswer en file.c de w3m 0.5.2, cuando se ejecuta con la opci\u00f3n de volcado (dump) o backend, permite a atacantes remotos ejecutar c\u00f3digo de su elecci\u00f3n mediante especificadores de cadena de formato en el campo Nombre Com\u00fan (Common Name o CN) de un certificado SSL."}], "id": "CVE-2006-6772", "lastModified": "2026-06-16T22:33:45.890", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 10.0, "obtainAllPrivilege": true, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2006-12-27T23:28:00.000", "references": [{"source": "cve@mitre.org", "url": "http://fedoranews.org/cms/node/2415"}, {"source": "cve@mitre.org", "url": "http://fedoranews.org/cms/node/2416"}, {"source": "cve@mitre.org", "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051457.html"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/23492"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/23588"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/23717"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/23773"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/23792"}, {"source": "cve@mitre.org", "url": "http://security.gentoo.org/glsa/glsa-200701-06.xml"}, {"source": "cve@mitre.org", "url": "http://securitytracker.com/id?1017440"}, {"source": "cve@mitre.org", "url": "http://sourceforge.net/tracker/index.php?func=detail&aid=1612792&group_id=39518&atid=425439"}, {"source": "cve@mitre.org", "url": "http://w3m.cvs.sourceforge.net/%2Acheckout%2A/w3m/w3m/NEWS?revision=1.79"}, {"source": "cve@mitre.org", "url": "http://w3m.cvs.sourceforge.net/w3m/w3m/file.c?r1=1.249&r2=1.250"}, {"source": "cve@mitre.org", "url": "http://w3m.cvs.sourceforge.net/w3m/w3m/file.c?view=log"}, {"source": "cve@mitre.org", "url": "http://www.novell.com/linux/security/advisories/2007_05_w3m.html"}, {"source": "cve@mitre.org", "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2006.044.html"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/21735"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/24332"}, {"source": "cve@mitre.org", "url": "http://www.ubuntu.com/usn/usn-399-1"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2006/5164"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31114"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34821"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://fedoranews.org/cms/node/2415"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://fedoranews.org/cms/node/2416"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051457.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/23492"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/23588"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/23717"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/23773"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/23792"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://security.gentoo.org/glsa/glsa-200701-06.xml"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securitytracker.com/id?1017440"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://sourceforge.net/tracker/index.php?func=detail&aid=1612792&group_id=39518&atid=425439"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://w3m.cvs.sourceforge.net/%2Acheckout%2A/w3m/w3m/NEWS?revision=1.79"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://w3m.cvs.sourceforge.net/w3m/w3m/file.c?r1=1.249&r2=1.250"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://w3m.cvs.sourceforge.net/w3m/w3m/file.c?view=log"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.novell.com/linux/security/advisories/2007_05_w3m.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2006.044.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/21735"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/24332"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.ubuntu.com/usn/usn-399-1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2006/5164"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31114"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34821"}], "sourceIdentifier": "cve@mitre.org", "vendorComments": [{"comment": "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", "lastModified": "2007-03-14T00:00:00", "organization": "Red Hat"}], "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-134"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "CVE-2006-6772 w3m is vulnerable to format string attack via CN field of SSL/TLS certificate when infoked with -dump/-backend", "id": "221484", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=221484"}, "csaw": false, "details": ["Format string vulnerability in the inputAnswer function in file.c in w3m before 0.5.2, when run with the dump or backend option, allows remote attackers to execute arbitrary code via format string specifiers in the Common Name (CN) field of an SSL certificate associated with an https URL."], "name": "CVE-2006-6772", "public_date": "2006-12-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2006-6772"], "statement": "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch."}

{}