Untrusted search path vulnerability in the add_filename_to_string function in intl/gettext/loadmsgcat.c for Elinks 0.11.1 allows local users to cause Elinks to use an untrusted gettext message catalog (.po file) in a ../po directory, which can be leveraged to conduct format string attacks.
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Elinks | Elinks | 0.11.1 (including) | 0.11.1 (including) |
| Red Hat Enterprise Linux 4 | RedHat | elinks-0:0.9.2-4.el4_8.1 | * |
| Red Hat Enterprise Linux 5 | RedHat | elinks-0:0.11.1-6.el5_4.1 | * |
| Elinks | Ubuntu | dapper | * |
| Elinks | Ubuntu | devel | * |
| Elinks | Ubuntu | edgy | * |
| Elinks | Ubuntu | feisty | * |