Lucene search
MitreCVE-2008-4690HistoryOct 22, 2008 - 6:00 p.m.
CVE-2008-4690
2008-10-2218:00:01
mitre
web.nvd.nist.gov
35
cve-2008-4690
lynx
remote code execution
url handler
lynxcgi
CVSS2
10
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
AI Score
7.1
Confidence
Low
EPSS
0.018
Percentile
88.2%
lynx 2.8.6dev.15 and earlier, when advanced mode is enabled and lynx is configured as a URL handler, allows remote attackers to execute arbitrary commands via a crafted lynxcgi: URL, a related issue to CVE-2005-2929. NOTE: this might only be a vulnerability in limited deployments that have defined a lynxcgi: handler.
Affected configurations
Node
lynxlynxRange≤2.8.6dev15
ORlynxlynxMatch2.8.1dev.1
ORlynxlynxMatch2.8.1dev.10
ORlynxlynxMatch2.8.1dev.11
ORlynxlynxMatch2.8.1dev.12
ORlynxlynxMatch2.8.1dev.13
ORlynxlynxMatch2.8.1dev.14
ORlynxlynxMatch2.8.1dev.15
ORlynxlynxMatch2.8.1dev.16
ORlynxlynxMatch2.8.1dev.17
ORlynxlynxMatch2.8.1dev.18
ORlynxlynxMatch2.8.1dev.19
ORlynxlynxMatch2.8.1dev.2
ORlynxlynxMatch2.8.1dev.20
ORlynxlynxMatch2.8.1dev.21
ORlynxlynxMatch2.8.1dev.22
ORlynxlynxMatch2.8.1dev.23
ORlynxlynxMatch2.8.1dev.24
ORlynxlynxMatch2.8.1dev.26
ORlynxlynxMatch2.8.1dev.27
ORlynxlynxMatch2.8.1dev.28
ORlynxlynxMatch2.8.1dev.29
ORlynxlynxMatch2.8.1dev.3
ORlynxlynxMatch2.8.1dev.4
ORlynxlynxMatch2.8.1dev.5
ORlynxlynxMatch2.8.1dev.6
ORlynxlynxMatch2.8.1dev.7
ORlynxlynxMatch2.8.1dev.8
ORlynxlynxMatch2.8.1dev.9
ORlynxlynxMatch2.8.1pre.1
ORlynxlynxMatch2.8.1pre.10
ORlynxlynxMatch2.8.1pre.11
ORlynxlynxMatch2.8.1pre.2
ORlynxlynxMatch2.8.1pre.3
ORlynxlynxMatch2.8.1pre.4
ORlynxlynxMatch2.8.1pre.5
ORlynxlynxMatch2.8.1pre.6
ORlynxlynxMatch2.8.1pre.7
ORlynxlynxMatch2.8.1pre.8
ORlynxlynxMatch2.8.1pre.9
ORlynxlynxMatch2.8.1rel.1
ORlynxlynxMatch2.8.1rel.2
ORlynxlynxMatch2.8.2dev.1
ORlynxlynxMatch2.8.2dev.10
ORlynxlynxMatch2.8.2dev.11
ORlynxlynxMatch2.8.2dev.12
ORlynxlynxMatch2.8.2dev.13
ORlynxlynxMatch2.8.2dev.14
ORlynxlynxMatch2.8.2dev.15
ORlynxlynxMatch2.8.2dev.16
ORlynxlynxMatch2.8.2dev.17
ORlynxlynxMatch2.8.2dev.18
ORlynxlynxMatch2.8.2dev.19
ORlynxlynxMatch2.8.2dev.2
ORlynxlynxMatch2.8.2dev.20
ORlynxlynxMatch2.8.2dev.21
ORlynxlynxMatch2.8.2dev.22
ORlynxlynxMatch2.8.2dev.23
ORlynxlynxMatch2.8.2dev.24
ORlynxlynxMatch2.8.2dev.25
ORlynxlynxMatch2.8.2dev.26
ORlynxlynxMatch2.8.2dev.3
ORlynxlynxMatch2.8.2dev.4
ORlynxlynxMatch2.8.2dev.5
ORlynxlynxMatch2.8.2dev.6
ORlynxlynxMatch2.8.2dev.7
ORlynxlynxMatch2.8.2dev.8
ORlynxlynxMatch2.8.2dev.9
ORlynxlynxMatch2.8.2pre.1
ORlynxlynxMatch2.8.2pre.10
ORlynxlynxMatch2.8.2pre.11
ORlynxlynxMatch2.8.2pre.2
ORlynxlynxMatch2.8.2pre.3
ORlynxlynxMatch2.8.2pre.4
ORlynxlynxMatch2.8.2pre.5
ORlynxlynxMatch2.8.2pre.6
ORlynxlynxMatch2.8.2pre.7
ORlynxlynxMatch2.8.2pre.8
ORlynxlynxMatch2.8.2pre.9
ORlynxlynxMatch2.8.2rel.1
ORlynxlynxMatch2.8.3dev.1
ORlynxlynxMatch2.8.3dev.10
ORlynxlynxMatch2.8.3dev.11
ORlynxlynxMatch2.8.3dev.12
ORlynxlynxMatch2.8.3dev.13
ORlynxlynxMatch2.8.3dev.14
ORlynxlynxMatch2.8.3dev.15
ORlynxlynxMatch2.8.3dev.16
ORlynxlynxMatch2.8.3dev.17
ORlynxlynxMatch2.8.3dev.18
ORlynxlynxMatch2.8.3dev.19
ORlynxlynxMatch2.8.3dev.2
ORlynxlynxMatch2.8.3dev.20
ORlynxlynxMatch2.8.3dev.21
ORlynxlynxMatch2.8.3dev.22
ORlynxlynxMatch2.8.3dev.23
ORlynxlynxMatch2.8.3dev.3
ORlynxlynxMatch2.8.3dev.4
ORlynxlynxMatch2.8.3dev.5
ORlynxlynxMatch2.8.3dev.6
ORlynxlynxMatch2.8.3dev.7
ORlynxlynxMatch2.8.3dev.8
ORlynxlynxMatch2.8.3dev.9
ORlynxlynxMatch2.8.3pre1
ORlynxlynxMatch2.8.3pre2
ORlynxlynxMatch2.8.3pre3
ORlynxlynxMatch2.8.3pre4
ORlynxlynxMatch2.8.3pre5
ORlynxlynxMatch2.8.3pre6
ORlynxlynxMatch2.8.3pre7
ORlynxlynxMatch2.8.3pre8
ORlynxlynxMatch2.8.3rel1
ORlynxlynxMatch2.8.4dev1
ORlynxlynxMatch2.8.4dev10
ORlynxlynxMatch2.8.4dev11
ORlynxlynxMatch2.8.4dev12
ORlynxlynxMatch2.8.4dev13
ORlynxlynxMatch2.8.4dev14
ORlynxlynxMatch2.8.4dev15
ORlynxlynxMatch2.8.4dev16
ORlynxlynxMatch2.8.4dev17
ORlynxlynxMatch2.8.4dev18
ORlynxlynxMatch2.8.4dev19
ORlynxlynxMatch2.8.4dev2
ORlynxlynxMatch2.8.4dev20
ORlynxlynxMatch2.8.4dev21
ORlynxlynxMatch2.8.4dev3
ORlynxlynxMatch2.8.4dev4
ORlynxlynxMatch2.8.4dev5
ORlynxlynxMatch2.8.4dev6
ORlynxlynxMatch2.8.4dev7
ORlynxlynxMatch2.8.4dev8
ORlynxlynxMatch2.8.4dev9
ORlynxlynxMatch2.8.4pre.1
ORlynxlynxMatch2.8.4pre.2
ORlynxlynxMatch2.8.4pre.3
ORlynxlynxMatch2.8.4pre.4
ORlynxlynxMatch2.8.4pre.5
ORlynxlynxMatch2.8.4rel.1
ORlynxlynxMatch2.8.5dev.1
ORlynxlynxMatch2.8.5dev.10
ORlynxlynxMatch2.8.5dev.11
ORlynxlynxMatch2.8.5dev.12
ORlynxlynxMatch2.8.5dev.13
ORlynxlynxMatch2.8.5dev.14
ORlynxlynxMatch2.8.5dev.15
ORlynxlynxMatch2.8.5dev.16
ORlynxlynxMatch2.8.5dev.17
ORlynxlynxMatch2.8.5dev.2
ORlynxlynxMatch2.8.5dev.3
ORlynxlynxMatch2.8.5dev.4
ORlynxlynxMatch2.8.5dev.5
ORlynxlynxMatch2.8.5dev.6
ORlynxlynxMatch2.8.5dev.7
ORlynxlynxMatch2.8.5dev.8
ORlynxlynxMatch2.8.5dev.9
ORlynxlynxMatch2.8.5pre.1
ORlynxlynxMatch2.8.5pre.2
ORlynxlynxMatch2.8.5pre.3
ORlynxlynxMatch2.8.5pre.4
ORlynxlynxMatch2.8.5pre.5
ORlynxlynxMatch2.8.5rel.1
ORlynxlynxMatch2.8.6dev1
ORlynxlynxMatch2.8.6dev10
ORlynxlynxMatch2.8.6dev11
ORlynxlynxMatch2.8.6dev12
ORlynxlynxMatch2.8.6dev13
ORlynxlynxMatch2.8.6dev14
ORlynxlynxMatch2.8.6dev2
ORlynxlynxMatch2.8.6dev3
ORlynxlynxMatch2.8.6dev4
ORlynxlynxMatch2.8.6dev5
ORlynxlynxMatch2.8.6dev6
ORlynxlynxMatch2.8.6dev7
ORlynxlynxMatch2.8.6dev8
ORlynxlynxMatch2.8.6dev9
| Vendor | Product | Version | CPE |
|---|---|---|---|
| lynx | lynx | * | cpe:2.3:a:lynx:lynx:*:dev15:*:*:*:*:*:* |
| lynx | lynx | 2.8.1 | cpe:2.3:a:lynx:lynx:2.8.1:dev.1:*:*:*:*:*:* |
| lynx | lynx | 2.8.1 | cpe:2.3:a:lynx:lynx:2.8.1:dev.10:*:*:*:*:*:* |
| lynx | lynx | 2.8.1 | cpe:2.3:a:lynx:lynx:2.8.1:dev.11:*:*:*:*:*:* |
| lynx | lynx | 2.8.1 | cpe:2.3:a:lynx:lynx:2.8.1:dev.12:*:*:*:*:*:* |
| lynx | lynx | 2.8.1 | cpe:2.3:a:lynx:lynx:2.8.1:dev.13:*:*:*:*:*:* |
| lynx | lynx | 2.8.1 | cpe:2.3:a:lynx:lynx:2.8.1:dev.14:*:*:*:*:*:* |
| lynx | lynx | 2.8.1 | cpe:2.3:a:lynx:lynx:2.8.1:dev.15:*:*:*:*:*:* |
| lynx | lynx | 2.8.1 | cpe:2.3:a:lynx:lynx:2.8.1:dev.16:*:*:*:*:*:* |
| lynx | lynx | 2.8.1 | cpe:2.3:a:lynx:lynx:2.8.1:dev.17:*:*:*:*:*:* |
References
lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html
secunia.com/advisories/32416
secunia.com/advisories/32967
secunia.com/advisories/33568
www.mandriva.com/security/advisories?name=MDVSA-2008:217
www.mandriva.com/security/advisories?name=MDVSA-2008:218
www.openwall.com/lists/oss-security/2008/10/09/2
www.redhat.com/support/errata/RHSA-2008-0965.html
www.securitytracker.com/id?1021105
exchange.xforce.ibmcloud.com/vulnerabilities/46228
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11204
www.redhat.com/archives/fedora-package-announce/2008-December/msg00066.html
www.redhat.com/archives/fedora-package-announce/2008-December/msg00143.html
Related
nvd
nvd
CVE-2008-4690
2008-10-22 18:00:01
CVE-2005-2929
2005-11-18 06:03:00
nessus
nessus
GLSA-200909-15 : Lynx: Arbitrary command execution
2009-09-14 00:00:00
Fedora 9 : lynx-2.8.6-17.fc9 (2008-9550)
2008-12-03 00:00:00
Fedora 10 : lynx-2.8.6-18.fc10 (2008-9952)
2009-04-23 00:00:00
openvas
openvas
Gentoo Security Advisory GLSA 200909-15 (lynx)
2009-09-15 00:00:00
Gentoo Security Advisory GLSA 200909-15 (lynx)
2009-09-15 00:00:00
Fedora Update for lynx FEDORA-2008-9597
2009-02-17 00:00:00
gentoo
gentoo
Lynx: Arbitrary command execution
2009-09-12 00:00:00
Lynx: Arbitrary command execution
2005-11-13 00:00:00
prion
prion
Sql injection
2008-10-22 18:00:00
ubuntucve
ubuntucve
CVE-2008-4690
2008-10-22 00:00:00
CVE-2005-2929
2005-11-18 00:00:00
debiancve
debiancve
CVE-2008-4690
2008-10-22 18:00:01
CVE-2005-2929
2005-11-18 11:00:00
cvelist
cvelist
CVE-2008-4690
2008-10-22 17:00:00
CVE-2005-2929
2005-11-18 11:00:00
fedora
fedora
[SECURITY] Fedora 10 Update: lynx-2.8.6-18.fc10
2008-12-03 01:19:13
[SECURITY] Fedora 9 Update: lynx-2.8.6-17.fc9
2008-12-03 01:19:24
[SECURITY] Fedora 8 Update: lynx-2.8.6-12.fc8
2008-12-03 01:25:01
securityvulns
securityvulns
[ MDVSA-2008:218 ] lynx
2008-10-29 00:00:00
lynx code execution
2008-10-29 00:00:00
redhat
redhat
(RHSA-2008:0965) Important: lynx security update
2008-10-27 00:00:00
(RHSA-2005:839) lynx security update
2005-11-11 00:00:00
oraclelinux
oraclelinux
lynx security update
2008-10-27 00:00:00
centos
centos
security update
2008-10-28 22:46:30
lynx security update
2008-10-27 20:12:24
lynx security update
2005-11-12 01:33:47
osv
osv
lynx-2.8.8rel.2-4.13 on GA media
2024-06-15 00:00:00
cve
cve
CVE-2005-2929
2005-11-18 11:00:00
CVSS2
10
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
AI Score
7.1
Confidence
Low
EPSS
0.018
Percentile
88.2%
Related for CVE-2008-4690