[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [FD] [oss-security] CVE request:Lynx invalid URL parsing with '?'

To: dickey@xxxxxxx
Subject: Re: [FD] [oss-security] CVE request:Lynx invalid URL parsing with '?'
From: Michal Zalewski <lcamtuf@xxxxxxxxxxx>
Date: Sat, 5 Nov 2016 00:05:35 -0700

> Actually, it does parse correctly.  Go read RFC 1738.

IIRC, RFC 3986 "fixes" that, and so does https://url.spec.whatwg.org/.

/mz

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

References:
- [FD] [oss-security] CVE request:Lynx invalid URL parsing with '?'
  - From: redrain root
- Re: [FD] [oss-security] CVE request:Lynx invalid URL parsing with '?'
  - From: Thomas Dickey

Prev by Date: Re: [FD] [oss-security] CVE request:Lynx invalid URL parsing with '?'
Next by Date: [FD] Actiontec WCB3000N (Telus Branded) Local Unauthenticated Privilege Elevation
Previous by thread: Re: [FD] [oss-security] CVE request:Lynx invalid URL parsing with '?'
Next by thread: [FD] KL-001-2016-008 : Sophos Web Appliance Privilege Escalation
Index(es):
- Date
- Thread