lynx: It was found that Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?', and could instead be tricked into connecting to a different host.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade lynx-curUpgrade lynx | Mar 31, 2017 | Nov 24, 2016 |
| Freebsd | — | Upgrade lynx | Jan 10, 2017 | Jan 9, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade lynx | Sep 28, 2020 | Dec 22, 2016 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | Dec 22, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Nov 3, 2016 |
| Suse | — | Upgrade lynx | Mar 4, 2017 | Dec 22, 2016 |
| Ubuntu | — | Upgrade lynx (Ubuntu Pro) | Mar 22, 2023 | Dec 22, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub