w3m through 0.5.3 does not properly handle temporary files when the ~/.w3m directory is unwritable, which allows a local attacker to craft a symlink attack to overwrite arbitrary files.
Already fixed. *** This bug has been marked as a duplicate of bug 22504 ***
Resolution: (none) => DUPLICATEStatus: NEW => RESOLVED