What is CVE-2018-6197?

CVE-2018-6197 is a high-severity software vulnerability (CWE-476) with a CVSS score of 7.5. w3m through 0.5.3 is prone to a NULL pointer dereference flaw in formUpdateBuffer in form.c.

Is CVE-2018-6197 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 4%.

What products does CVE-2018-6197 affect?

Tracked products affected include Ubuntu. Check the version you run to see whether it is affected.

How do I fix CVE-2018-6197?

Apply the vendor fix promptly. An official patch or advisory is available. Upgrade affected products to a fixed version.

← All products

CVE-2018-6197

HIGH severity · CVSS 7.5 · CWE-476

7.5CVSS HIGH

Summary

w3m through 0.5.3 is prone to a NULL pointer dereference flaw in formUpdateBuffer in form.c.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

Confidentiality impactNone

Integrity impactNone

Availability impactHigh

Exploit probability (EPSS)4%

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products we track (1)

Ubuntu

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Official patch: https://github.com/tats/w3m/commit/7fdc83b0364005a0b5ed869230dd81752ba022e8 ↗

Additional information

NVD record
https://github.com/tats/w3m/commit/7fdc83b0364005a0b5ed869230dd81752ba022e8Patch
https://github.com/tats/w3m/issues/89Patch
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00028.html
http://www.securityfocus.com/bid/102846Advisory
https://lists.debian.org/debian-lts-announce/2020/04/msg00025.html
https://usn.ubuntu.com/3555-1/Advisory
https://usn.ubuntu.com/3555-2/Advisory