Re: CVE request: lynx (old) .mailcap handling flaw

[Tavis Ormandy <taviso () sdf lonestar org>]

On Sat, Oct 25, 2008 at 08:27:51PM +0200, Tomas Hoger wrote:
> Hi Steven!
>
> There's one old lynx issue that seem to need a 2006 CVE id.  lynx
> browser prior to 2.8.6rel.4 tries to open mailcap and mime type
> definition files form the current directory.  If user can be convinced
> to run lynx in a specially crafted directory, an attacker controlling
> the directory may be able to run arbitrary code as the victim running
> lynx.

That reminds me, I recently noticed valgrind also does this.

$ printf -- "--db-command=/usr/bin/id\n--db-attach=yes\n" > /tmp/.valgrindrc

Etc.

Thanks, Tavis.

-- 
-------------------------------------
taviso () sdf lonestar org | finger me for my gpg key.
-------------------------------------------------------