CVE-2016-9179
HighSummary
It was found that Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?'. This could lead to the program connecting to a different host.
Risk Assessment
An attacker could exploit this vulnerability to intercept traffic or redirect users to a malicious server, posing a serious threat to data security.
Recommendation
It is recommended to update Lynx to the latest version that fixes this vulnerability and to review and verify used URLs before establishing a connection.
Other vulnerabilities in Lynx
See all- CVE-2000-0209High
Buffer overflow in Lynx 2.x allows remote attackers to crash Lynx and possibly execute commands via a long URL in a malicious web page.
- CVE-1999-1549High
Lynx 2.x does not properly distinguish between internal and external HTML, which may allow a local attacker to read a 'secure' hidden form value from a temporary file and craft a LYNXOPTIONS: URL that causes Lynx to modify the user's configuration file and execute commands.
- CVE-1999-0371Low
Lynx allows a local user to overwrite sensitive files through /tmp symlinks.
Original NVD description (English source)
lynx: It was found that Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?', and could instead be tricked into connecting to a different host.