Arnaud Giersch discovered that elinks incorrectly attempted to load gettext catalogs from a relative path. If a user were tricked into running elinks from a specific directory, a local attacker could execute code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated elinks package that fixes two security issues is now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

ELinks is a text-based Web browser. ELinks does not display any images, but it does support frames, tables, and most other HTML tags.

An off-by-one buffer overflow flaw was discovered in the way ELinks handled its internal cache of string representations for HTML special entities. A remote attacker could use this flaw to create a specially crafted HTML file that would cause ELinks to crash or, possibly, execute arbitrary code when rendered. (CVE-2008-7224)

It was discovered that ELinks tried to load translation files using relative paths. A local attacker able to trick a victim into running ELinks in a folder containing specially crafted translation files could use this flaw to confuse the victim via incorrect translations, or cause ELinks to crash and possibly execute arbitrary code via embedded formatting sequences in translated messages. (CVE-2007-2027)

All ELinks users are advised to upgrade to this updated package, which contains backported patches to resolve these issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix #235411 - CVE-2007-2027 - elinks tries to load .po     files from non-absolute path

  - fix #523258 - CVE-2008-7224 - entity_cache static array     buffer overflow

The remote host is affected by the vulnerability described in GLSA-200706-03 (ELinks: User-assisted execution of arbitrary code)

    Arnaud Giersch discovered that the 'add_filename_to_string()' function     in file intl/gettext/loadmsgcat.c uses an untrusted relative path,     allowing for a format string attack with a malicious .po file.
  Impact :

    A local attacker could entice a user to run ELinks in a specially     crafted directory environment containing a malicious '.po' file,     possibly resulting in the execution of arbitrary code with the     privileges of the user running ELinks.
  Workaround :

    There is no known workaround at this time.

The remote MiracleLinux 3 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2009-406:01 advisory.

    Links is a text-based Web browser. Links does not display any images, but it does support frames, tables     and most other HTML tags. Links' advantage over graphical browsers is its speed--Links starts and exits     quickly and swiftly displays Web pages.
    Security bugs fixed with this release:
    CVE-2007-2027     Untrusted search path vulnerability in the add_filename_to_string function in intl/gettext/loadmsgcat.c     for Elinks 0.11.1 allows local users to cause Elinks to use an untrusted gettext message catalog (.po     file) in a ../po directory, which can be leveraged to conduct format string attacks.
    CVE-2008-7224     Buffer overflow in entity_cache in ELinks before 0.11.4rc0 allows remote attackers to cause a denial of     service (crash) via a crafted link.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CVE-2007-2027 elinks tries to load .po files from a non-absolute path

CVE-2008-7224 elinks: entity_cache static array buffer overflow (off-by-one)

An off-by-one buffer overflow flaw was discovered in the way ELinks handled its internal cache of string representations for HTML special entities. A remote attacker could use this flaw to create a specially crafted HTML file that would cause ELinks to crash or, possibly, execute arbitrary code when rendered. (CVE-2008-7224)

It was discovered that ELinks tried to load translation files using relative paths. A local attacker able to trick a victim into running ELinks in a folder containing specially crafted translation files could use this flaw to confuse the victim via incorrect translations, or cause ELinks to crash and possibly execute arbitrary code via embedded formatting sequences in translated messages. (CVE-2007-2027)

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2009-1471 advisory.

    - fix #235411 - CVE-2007-2027 - elinks tries to load .po files       from non-absolute path

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
28055	Ubuntu 6.06 LTS / 6.10 / 7.04 : elinks vulnerability (USN-457-1)	Nessus	Ubuntu Local Security Checks	11/10/2007	1/19/2021	medium
43798	CentOS 4 / 5 : elinks (CESA-2009:1471)	Nessus	CentOS Local Security Checks	1/6/2010	1/4/2021	high
41962	RHEL 4 / 5 : elinks (RHSA-2009:1471)	Nessus	Red Hat Local Security Checks	10/2/2009	1/14/2021	high
79468	OracleVM 2.1 : elinks (OVMSA-2009-0030)	Nessus	OracleVM Local Security Checks	11/26/2014	1/14/2021	high
25453	GLSA-200706-03 : ELinks: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	6/7/2007	1/6/2021	medium
284297	MiracleLinux 3 : elinks-0.11.1-6AXS3.1 (AXSA:2009-406:01)	Nessus	Miracle Linux Local Security Checks	1/14/2026	1/14/2026	critical
60673	Scientific Linux Security Update : elinks on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	high
67934	Oracle Linux 5 : elinks (ELSA-2009-1471)	Nessus	Oracle Linux Local Security Checks	7/12/2013	10/22/2024	critical

Detections

Analytics

Plugins Search

medium

high

high

high

medium

critical

high

critical