Please Install the Updated Packages.

Lynx is a text-based Web browser. An arbitrary command execution flaw was found in the Lynx &quot lynxcgi:&quot URI handler. An attacker could create a web page redirecting to a malicious URL that could execute arbitrary code as the user running Lynx in the non-default &quot Advanced&quot user mode. (CVE-2008-4690) Note: In these updated lynx packages, Lynx will always prompt users before loading a &quot lynxcgi:&quot URI. Additionally, the default lynx.cfg configuration file now marks all &quot lynxcgi:&quot URIs as untrusted by default. A flaw was found in a way Lynx handled &quot .mailcap&quot and &quot .mime.types&quot configuration files. Files in the browser's current working directory were opened before those in the user's home directory. A local attacker, able to convince a user to run Lynx in a directory under their control, could possibly execute arbitrary commands as the user running Lynx. (CVE-2006-7234) All users of Lynx are advised to upgrade to this updated package, which contains backported patches correcting these issues.

lynx on Red Hat Enterprise Linux AS (Advanced Server) version 2.1, Red Hat Enterprise Linux ES version 2.1, Red Hat Enterprise Linux WS version 2.1, Red Hat Enterprise Linux AS version 3, Red Hat Enterprise Linux ES version 3, Red Hat Enterprise Linux WS version 3, Red Hat Enterprise Linux AS version 4, Red Hat Enterprise Linux ES version 4, Red Hat Enterprise Linux WS version 4, Red Hat Enterprise Linux (v. 5 server)

• https://www.redhat.com/archives/rhsa-announce/2008-October/msg00016.html

---

Updated on 2015-03-25