HIGH
CVE-2006-6772 w3m is vulnerable to format string attack via CN field of SSL/TLS certificate when infoked with -dump/-backend
Published Dec 27, 2006
9.3
HIGHCVSS 2.0
EPSS 4.82%
Description
Format string vulnerability in the inputAnswer function in file.c in w3m before 0.5.2, when run with the dump or backend option, allows remote attackers to execute arbitrary code via format string specifiers in the Common Name (CN) field of an SSL certificate associated with an https URL.
Affected products
Remediation
Red Hat statement
Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.
Metrics
No CVSS v4.0 score for this CVE.
No CVSS v3.1 score for this CVE.
No CVSS v3.0 score for this CVE.
9.3 HIGH NVD
AV:N/AC:M/Au:N/C:C/I:C/A:C
Access Vector Network
Access Complexity Medium
Authentication None
Confidentiality Impact Complete
Integrity Impact Complete
Availability Impact Complete
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
4.82% 0.04822
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
EPSS probability 0.04822
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (20 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 4.82% (0.04822) | 91.70th | v5 (v2026.06.15) |
| Jun 15, 2026 | 4.67% (0.04665) | 90.55th | v5 (v2026.06.15) |
| Nov 10, 2025 | 13.76% (0.13757) | 93.98th | v4 (v2025.03.14) |
| Aug 8, 2025 | 11.34% (0.11345) | 93.26th | v4 (v2025.03.14) |
| Mar 30, 2025 | 13.30% (0.13301) | 93.55th | v4 (v2025.03.14) |
| Mar 29, 2025 | 20.26% (0.20259) | 92.69th | v4 (v2025.03.14) |
| Mar 17, 2025 | 13.30% (0.13301) | 93.62th | v4 (v2025.03.14) |
| Dec 17, 2024 | 21.05% (0.21053) | 96.41th | v3 (v2023.03.01) |
| Jul 8, 2024 | 15.15% (0.15155) | 95.88th | v3 (v2023.03.01) |
| Dec 8, 2023 | 12.72% (0.12725) | 94.92th | v3 (v2023.03.01) |
| Nov 8, 2023 | 10.36% (0.10358) | 94.40th | v3 (v2023.03.01) |
| Oct 31, 2023 | 12.06% (0.12064) | 94.75th | v3 (v2023.03.01) |
| Sep 23, 2023 | 13.50% (0.13497) | 94.93th | v3 (v2023.03.01) |
| Aug 16, 2023 | 14.08% (0.14076) | 94.98th | v3 (v2023.03.01) |
| May 31, 2023 | 13.65% (0.13654) | 94.78th | v3 (v2023.03.01) |
| Apr 23, 2023 | 9.98% (0.09985) | 93.96th | v3 (v2023.03.01) |
| Mar 7, 2023 | 10.14% (0.10143) | 93.97th | v3 (v2023.03.01) |
| Mar 6, 2023 | 9.92% (0.09915) | 94.52th | v2 (v2022.01.01) |
| Apr 1, 2022 | 9.92% (0.09915) | 94.04th | v2 (v2022.01.01) |
| Feb 4, 2022 | 9.92% (0.09915) | 87.53th | v2 (v2022.01.01) |
Weaknesses (1)
References (26)
- http://fedoranews.org/cms/node/2415 vendor-advisoryx_refsource_FEDORA
- http://fedoranews.org/cms/node/2416 vendor-advisoryx_refsource_FEDORA
- http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051457.html mailing-listx_refsource_FULLDISC
- http://secunia.com/advisories/23492 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/23588 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/23717 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/23773 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/23792 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://security.gentoo.org/glsa/glsa-200701-06.xml vendor-advisoryx_refsource_GENTOO
- http://securitytracker.com/id?1017440 vdb-entryx_refsource_SECTRACK
- http://sourceforge.net/tracker/index.php?func=detail&aid=1612792&group_id=39518&atid=425439 x_refsource_MISC
- http://w3m.cvs.sourceforge.net/%2Acheckout%2A/w3m/w3m/NEWS?revision=1.79 x_refsource_CONFIRM
- http://w3m.cvs.sourceforge.net/w3m/w3m/file.c?r1=1.249&r2=1.250 x_refsource_CONFIRM
- http://w3m.cvs.sourceforge.net/w3m/w3m/file.c?view=log x_refsource_CONFIRM
- http://www.novell.com/linux/security/advisories/2007_05_w3m.html vendor-advisoryx_refsource_SUSE
- http://www.openpkg.com/security/advisories/OpenPKG-SA-2006.044.html vendor-advisoryx_refsource_OPENPKG
- http://www.securityfocus.com/bid/21735 vdb-entryx_refsource_BID
- http://www.securityfocus.com/bid/24332 vdb-entryx_refsource_BID
- http://www.ubuntu.com/usn/usn-399-1 vendor-advisoryx_refsource_UBUNTU
- http://www.vupen.com/english/advisories/2006/5164 vdb-entryx_refsource_VUPENVendor Advisory
- https://access.redhat.com/security/cve/CVE-2006-6772 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=221484 Issue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/31114 vdb-entryx_refsource_XF
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34821 vdb-entryx_refsource_XF
- https://nvd.nist.gov/vuln/detail/CVE-2006-6772
- https://www.cve.org/CVERecord?id=CVE-2006-6772
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Dec 27, 2006
Updated Aug 7, 2024
Reserved Dec 27, 2006
Link CVE-2006-6772
CISA Vulnrichment
Updated n/a