Installed versions of Lynx up to and including version 2.7.1 on Unix or Unix-like operating systems are vulnerable. This includes public Lynxes as well as any setup where the user is restricted as to which programs can be run. Patches you may find from before that date may not entirely eliminate the vulnerability. All systems running Lynx versions 2.7.1 or earlier should be updated to fix this problem. If you believe you have found a security problem with the current version of Lynx, we urge you to forward it to the LYNX-DEV mailing list at .
More help is available in the source distribution.
Should your questions not be answered by these means, further questions may be directed to . The CERT Coordination Center staff thanks Aaron of Internet Maine for calling our attention to the problem and thanks Jim Spath and his lynx-dev colleagues for their cooperation in developing this bulletin. Contact the CERT staff for more information. The SEI is sponsored by the U. S. Department of Defense.