CVE-2004-1617
Medium
Description
Lynx, lynx-ssl, and lynx-cur before 2.8.6dev.8 allow remote attackers to cause a denial of service (infinite loop) via a web page or HTML email that contains invalid HTML including (1) a TEXTAREA tag with a large COLS value and (2) a large tag name in an element that is not terminated, as demonstrated by mangleme. NOTE: a followup suggests that the relevant trigger for this issue is the large COLS value.
SeverityMedium
CVSS5.0
Exploit probability—
ProductUniversity Of Kansas Lynx
PublishedOct 18, 2004
First seenOct 18, 2004
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| university_of_kansas lynx | 2.7, 2.8, 2.8.1, 2.8.2_rel1, 2.8.3, 2.8.3_dev22, 2.8.3_pre5, 2.8.3_rel1, 2.8.4, 2.8.4_rel1, 2.8.5, 2.8.5_dev2, 2.8.5_dev3, 2.8.5_dev4, 2.8.5_dev5, 2.8.5_dev8 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.