The SCOSA-2006.7 (Lynx Multiple Vulnerabilities) security update,
released on 01/10/2006, breaks /usr/bin/html2ascii. This is true for
OSR 5.0.7 and 6.0.0, but the update is also specified for OSR 5.0.6, so
may break things there too.

html2ascii is used by /usr/bin/man to display html manual pages. If,
in /etc/default/man, MAN_HTML2ASCII specifies lynx as the html
renderer, then this problem will also affect the man command. The
symptoms are that man will display the lynx usage message rather than
the requested manual page.

The fix is to edit /usr/bin/html2ascii and remove the -justify=off
option from the line where lynx is invoked. The version of lynx
installed by this update apparently does not accept this option.

Roger Cornelius typed (on Fri, Jan 13, 2006 at 10:34:33AM -0800):
| The SCOSA-2006.7 (Lynx Multiple Vulnerabilities) security update,
| released on 01/10/2006, breaks /usr/bin/html2ascii. This is true for
| OSR 5.0.7 and 6.0.0, but the update is also specified for OSR 5.0.6, so
| may break things there too.
|
| html2ascii is used by /usr/bin/man to display html manual pages. If,
| in /etc/default/man, MAN_HTML2ASCII specifies lynx as the html
| renderer, then this problem will also affect the man command. The
| symptoms are that man will display the lynx usage message rather than
| the requested manual page.
|
| The fix is to edit /usr/bin/html2ascii and remove the -justify=off
| option from the line where lynx is invoked. The version of lynx
| installed by this update apparently does not accept this option.

5.0.6 won't see this problem, since html2ascii is an entirely different
beast there, not relying on lynx at all.

The security folk at SCO have told me that they working on a revision to
SCOSA-2006.7.

==> http://www.frappr.com/cusm <==

Jean-Pierre Radley typed (on Fri, Jan 13, 2006 at 05:33:34PM -0500):
| Roger Cornelius typed (on Fri, Jan 13, 2006 at 10:34:33AM -0800):
| | The SCOSA-2006.7 (Lynx Multiple Vulnerabilities) security update,
| | released on 01/10/2006, breaks /usr/bin/html2ascii. This is true for
| | OSR 5.0.7 and 6.0.0, but the update is also specified for OSR 5.0.6, so
| | may break things there too.
| |
| | html2ascii is used by /usr/bin/man to display html manual pages. If,
| | in /etc/default/man, MAN_HTML2ASCII specifies lynx as the html
| | renderer, then this problem will also affect the man command. The
| | symptoms are that man will display the lynx usage message rather than
| | the requested manual page.
| |
| | The fix is to edit /usr/bin/html2ascii and remove the -justify=off
| | option from the line where lynx is invoked. The version of lynx
| | installed by this update apparently does not accept this option.
|
| 5.0.6 won't see this problem, since html2ascii is an entirely different
| beast there, not relying on lynx at all.
|
| The security folk at SCO have told me that they working on a revision to
| SCOSA-2006.7.

I see that SCOSA-2006.7.1 has appeared at ftp.sco.com.

--
JP
==> http://www.frappr.com/cusm <==

Jean-Pierre Radley wrote:
> Jean-Pierre Radley typed (on Fri, Jan 13, 2006 at 05:33:34PM -0500):
> | Roger Cornelius typed (on Fri, Jan 13, 2006 at 10:34:33AM -0800):
> | | The SCOSA-2006.7 (Lynx Multiple Vulnerabilities) security update,
> | | released on 01/10/2006, breaks /usr/bin/html2ascii. This is true for
> | | OSR 5.0.7 and 6.0.0, but the update is also specified for OSR 5.0.6, so
> | | may break things there too.
> | |
> | | html2ascii is used by /usr/bin/man to display html manual pages. If,
> | | in /etc/default/man, MAN_HTML2ASCII specifies lynx as the html
> | | renderer, then this problem will also affect the man command. The
> | | symptoms are that man will display the lynx usage message rather than
> | | the requested manual page.
> | |
> | | The fix is to edit /usr/bin/html2ascii and remove the -justify=off
> | | option from the line where lynx is invoked. The version of lynx
> | | installed by this update apparently does not accept this option.
> |
> | 5.0.6 won't see this problem, since html2ascii is an entirely different
> | beast there, not relying on lynx at all.
> |
> | The security folk at SCO have told me that they working on a revision to
> | SCOSA-2006.7.
>
> I see that SCOSA-2006.7.1 has appeared at ftp.sco.com.

Yes, and I noticed the .txt file describing the updated version states
"lynx has been updated to version 2.8.5dev.8" but the version installed
is actually 2.8.5rel.5.