w3m before 0.3.2.2 does not properly escape HTML tags in the ALT attribute of an IMG tag, which could allow remote attackers to access files or cookies.

Hironori Sakamoto, one of the w3m developers, found two security vulnerabilities in w3m and associated programs. The w3m browser does not properly escape HTML tags in frame contents and img alt attributes. A malicious HTML frame or img alt attribute may deceive a user to send their local cookies which are used for configuration. The information is not leaked automatically, though.

Updated W3M packages are available that fix two cross-site scripting issues.

W3M is a pager with Web browsing capabilities. Two cross-site scripting (XSS) issues have been found in W3M.

An XSS vulnerability in W3M 0.3.2 allows remote attackers to insert arbitrary HTML and Web script into frames. Frames are disabled by default in the version of W3M shipped with Red Hat Linux Advanced Server and Red Hat Linux Advanced Workstation. Therefore, this problem will not appear as long as users do not use W3M with the -F option, or enable frame support in either the /etc/w3m/w3mconfig or ~/.w3m/config configuration files. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2002-1335 to this issue.

An XSS vulnerability in versions of W3M before 0.3.2.2 allows attackers to insert arbitrary HTML and Web script into image attributes. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2002-1348 to this issue.

Users of W3M are advised to upgrade to the updated packages containing W3M 0.2.1 and a patch to correct these vulnerabilities.

ID	Name	Product	Family	Severity
15088	Debian DSA-251-1 : w3m - missing HTML quoting	Nessus	Debian Local Security Checks	medium
15087	Debian DSA-250-1 : w3mmee-ssl - missing HTML quoting	Nessus	Debian Local Security Checks	medium
15086	Debian DSA-249-1 : w3mmee - missing HTML quoting	Nessus	Debian Local Security Checks	medium
12360	RHEL 2.1 : w3m (RHSA-2003:045)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2002-1348

high

Tenable Plugins

medium

medium

medium

medium