From Red Hat Security Advisory 2007:0933 :

An updated ELinks package that corrects a security vulnerability is now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

ELinks is a text mode Web browser used from the command line that supports rendering modern web pages.

An information disclosure flaw was found in the way ELinks passes https POST data to a proxy server. POST data sent via a proxy to an https site is not properly encrypted by ELinks, possibly allowing the disclosure of sensitive information. (CVE-2007-5034)

All users of Elinks are advised to upgrade to this updated package, which contains a backported patch that resolves this issue.

Update done because of security issue in elinks 0.11.2 , in this update are included other changes done in devel branch meanwhile(license tags,open macro,license file missing,duplicate buildrequires).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Details :

An information disclosure flaw was found in the way ELinks passes https POST data to a proxy server. POST data sent via a proxy to an https site is not properly encrypted by ELinks, possibly allowing the disclosure of sensitive information. (CVE-2007-5034)

Red Hat セキュリティアドバイザリ 2007:0933 から：

セキュリティの脆弱性を修正する更新済みの ELinks パッケージが、Red Hat Enterprise Linux 4 および 5 で現在利用可能です。

Red Hat セキュリティレスポンスチームは、この更新は重要度中のセキュリティ影響があると評価しています。

ELinks は、モダン Web ページのレンダリングをサポートする、コマンドラインから使用されるテキストモードの Web ブラウザです。

ELinks がプロキシサーバーに https POST データを受け渡す方法に情報漏洩の欠陥が見つかりました。プロキシ経由で https サイトに送信される POST データが Elinks により適切に暗号化されないため、機密情報の漏洩が発生する可能性があります。(CVE-2007-5034)

Elinks の全ユーザーは、バックポートされたパッチが含まれるこの更新済みパッケージへアップグレードし、この問題を解決することが推奨されます。

詳細：

ELinks がプロキシサーバーに https POST データを受け渡す方法に情報漏洩の欠陥が見つかりました。プロキシ経由で https サイトに送信される POST データが Elinks により適切に暗号化されないため、機密情報の漏洩が発生する可能性があります。（CVE-2007-5034）

來自 Red Hat 安全性公告 2007:0933：

現已提供適用於 Red Hat Enterprise Linux 4 和 5 的更新版 ELinks 套件，可更正一個安全性弱點。

Red Hat 安全性回應團隊已將此更新評等為具有中等安全性影響。

ELinks 是從命令行使用的文字模式網頁瀏覽器，支援轉譯現代化網頁。

在 ELinks 將 https POST 資料傳送至 Proxy 伺服器的方式中發現資訊洩漏瑕疵。ELinks 不會正確加密透過 Proxy 傳送至 https 網站的 POST 資料，這可能允許洩漏敏感資訊。(CVE-2007-5034)

建議所有 Elinks 使用者皆升級至此更新版套件，其中包含一個可解決此問題的反向移植修補程式。

来自 Red Hat 安全公告 2007:0933：

更新后的 ELinks 程序包修复了一个安全漏洞，现在可用于 Red Hat Enterprise Linux 4 和 5。

Red Hat 安全响应团队将此更新评级为具有中等安全影响。

Elinks 是一款从命令行使用的文本模式 Web 浏览器，支持渲染现代网页。

在 ELinks 将 https POST 数据传递到代理服务器的方式中发现信息泄露缺陷。ELinks 未正确加密通过代理发送到 https 站点的 POST 数据，可能导致敏感信息泄露。(CVE-2007-5034)

建议所有 Elinks 用户升级到此更新后的程序包，其中包含用于解决此问题的向后移植的修补程序。

詳細資訊：

在 ELinks 將 https POST 資料傳送至 Proxy 伺服器的方式中發現資訊洩漏瑕疵。ELinks 不會正確加密透過 Proxy 傳送至 https 網站的 POST 資料，這可能允許洩漏敏感資訊。(CVE-2007-5034)

详细信息：

在 ELinks 将 https POST 数据传递到代理服务器的方式中发现信息泄露缺陷。ELinks 未正确加密通过代理发送到 https 站点的 POST 数据，可能导致敏感信息泄露。(CVE-2007-5034)

Kalle Olavi Niemitalo discovered that if elinks makes a POST request to an HTTPS URL through a proxy, information may be sent in clear-text between elinks and the proxy. Attackers with access to the network could steal sensitive information (such as passwords).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Kalle Olavi Niemitalo discovered that elinks, an advanced text-mode WWW browser, sent HTTP POST data in cleartext when using an HTTPS proxy server potentially allowing private information to be disclosed.

An updated ELinks package that corrects a security vulnerability is now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

ELinks is a text mode Web browser used from the command line that supports rendering modern web pages.

An information disclosure flaw was found in the way ELinks passes https POST data to a proxy server. POST data sent via a proxy to an https site is not properly encrypted by ELinks, possibly allowing the disclosure of sensitive information. (CVE-2007-5034)

All users of Elinks are advised to upgrade to this updated package, which contains a backported patch that resolves this issue.

Jump to new upstream version because of security issue #297991/done some other changes already committed to devel

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
67576	Oracle Linux 4 / 5 : elinks (ELSA-2007-0933)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
27761	Fedora 7 : elinks-0.11.3-1.fc7 (2007-2224)	Nessus	Fedora Local Security Checks	2007/11/6	2021/1/11	medium
60259	Scientific Linux Security Update : elinks on SL5.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
67576	Oracle Linux 4/5：elinks（ELSA-2007-0933）	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
60259	Scientific Linux セキュリティ更新：SL5.x、SL4.x i386/x86_64 の elinks	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
67576	Oracle Linux 4 / 5 : elinks (ELSA-2007-0933)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
67576	Oracle Linux 4 / 5：elinks (ELSA-2007-0933)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
60259	Scientific Linux 安全性更新：SL5.x、SL4.x i386/x86_64 上的 elinks	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
60259	Scientific Linux 安全更新：SL5.x、SL4.x i386/x86_64 中的 elinks	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
28124	Ubuntu 6.06 LTS / 6.10 / 7.04 : elinks vulnerability (USN-519-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	medium
26210	Debian DSA-1380-1 : elinks - programming error	Nessus	Debian Local Security Checks	2007/10/3	2021/1/4	medium
26929	CentOS 4 / 5 : elinks (CESA-2007:0933)	Nessus	CentOS Local Security Checks	2007/10/9	2021/1/4	medium
26932	Fedora Core 6 : elinks-0.11.3-1.fc6 (2007-710)	Nessus	Fedora Local Security Checks	2007/10/9	2021/1/11	medium
26954	RHEL 4 / 5 : elinks (RHSA-2007:0933)	Nessus	Red Hat Local Security Checks	2007/10/9	2021/1/14	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium