CVE-2006-7234 — lynx: .mailcap and .mime.types files read from CWD

Back Back to CVE browser

MEDIUM

lynx: .mailcap and .mime.types files read from CWD

Published Oct 27, 2008

4.6

MEDIUM

CVSS 2.0

EPSS 0.88%

Description

Untrusted search path vulnerability in Lynx before 2.8.6rel.4 allows local users to execute arbitrary code via malicious (1) .mailcap and (2) mime.types files in the current working directory.

Affected products

Red Hat Enterprise Linux 2.1

lynx-0:2.8.4-18.1.3

Fixed · RHSA-2008:0965
Red Hat Enterprise Linux 3

lynx-0:2.8.5-11.3

Fixed · RHSA-2008:0965
Red Hat Enterprise Linux 4

lynx-0:2.8.5-18.2.el4_7.1

Fixed · RHSA-2008:0965
Red Hat Enterprise Linux 5

lynx-0:2.8.5-28.1.el5_2.1

Fixed · RHSA-2008:0965

Product	Package	State	Advisory
Red Hat Enterprise Linux 2.1	lynx-0:2.8.4-18.1.3	Fixed	RHSA-2008:0965
Red Hat Enterprise Linux 3	lynx-0:2.8.5-11.3	Fixed	RHSA-2008:0965
Red Hat Enterprise Linux 4	lynx-0:2.8.5-18.2.el4_7.1	Fixed	RHSA-2008:0965
Red Hat Enterprise Linux 5	lynx-0:2.8.5-28.1.el5_2.1	Fixed	RHSA-2008:0965

Remediation

No remediation recorded yet.

Metrics

0.88% 0.00882

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.00882

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (8 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	0.88% (0.00882)	57.76th	v5 (v2026.06.15)
Jun 15, 2026	0.88% (0.00882)	54.27th	v5 (v2026.06.15)
Mar 17, 2025	0.12% (0.00117)	28.11th	v4 (v2025.03.14)
Dec 12, 2024	0.04% (0.00042)	0.34th	v3 (v2023.03.01)
Mar 7, 2023	0.04% (0.00042)	0.50th	v3 (v2023.03.01)
Mar 6, 2023	5.63% (0.05625)	90.08th	v2 (v2022.01.01)
Apr 1, 2022	5.63% (0.05625)	89.09th	v2 (v2022.01.01)
Feb 4, 2022	5.63% (0.05625)	76.72th	v2 (v2022.01.01)

Weaknesses (0)

No CWE recorded.

References (16)

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=396949
x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html
vendor-advisoryx_refsource_SUSE
http://secunia.com/advisories/32407
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/32416
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/33568
third-party-advisoryx_refsource_SECUNIA
http://www.mandriva.com/security/advisories?name=MDVSA-2008:217
vendor-advisoryx_refsource_MANDRIVA
http://www.openwall.com/lists/oss-security/2008/10/25/3
mailing-listx_refsource_MLIST
http://www.redhat.com/support/errata/RHSA-2008-0965.html
vendor-advisoryx_refsource_REDHAT
http://www.securityfocus.com/bid/31917
vdb-entryx_refsource_BID
http://www.securitytracker.com/id?1021107
vdb-entryx_refsource_SECTRACK
https://access.redhat.com/security/cve/CVE-2006-7234
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=214205
x_refsource_CONFIRMIssue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/46132
vdb-entryx_refsource_XF
https://nvd.nist.gov/vuln/detail/CVE-2006-7234
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9719
vdb-entrysignaturex_refsource_OVAL
https://www.cve.org/CVERecord?id=CVE-2006-7234

Link	Providers	Tags
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=396949		x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html		vendor-advisoryx_refsource_SUSE
http://secunia.com/advisories/32407		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/32416		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/33568		third-party-advisoryx_refsource_SECUNIA
http://www.mandriva.com/security/advisories?name=MDVSA-2008:217		vendor-advisoryx_refsource_MANDRIVA
http://www.openwall.com/lists/oss-security/2008/10/25/3		mailing-listx_refsource_MLIST
http://www.redhat.com/support/errata/RHSA-2008-0965.html		vendor-advisoryx_refsource_REDHAT
http://www.securityfocus.com/bid/31917		vdb-entryx_refsource_BID
http://www.securitytracker.com/id?1021107		vdb-entryx_refsource_SECTRACK
https://access.redhat.com/security/cve/CVE-2006-7234		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=214205		x_refsource_CONFIRMIssue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/46132		vdb-entryx_refsource_XF
https://nvd.nist.gov/vuln/detail/CVE-2006-7234
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9719		vdb-entrysignaturex_refsource_OVAL
https://www.cve.org/CVERecord?id=CVE-2006-7234