PT-2015-6972 · Html Tidy+3 · Tidy+3

Fernando Muñoz · Publicado 2015-07-16 · Atualizado 2024-06-15 · CVE-2015-5523

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions tidy versions prior to 4.9.31

Description The issue allows remote attackers to cause a denial of service (crash) via vectors involving multiple whitespace characters before an empty href, which triggers a large memory allocation. This occurs due to a problem in the ParseValue function in lexer.c.

Recommendations For versions prior to 4.9.31, update to version 4.9.31 or later to resolve the issue.

Exploit

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALT-PU-2017-2636

CVE-2015-5523

DLA-273-1

DSA-3309-1

OPENSUSE-SU-2024:10210-1

SUSE-SU-2015:1513-1

SUSE-SU-2015:1525-1

USN-2695-1

Produtos afetados

Alt Linux

Suse

Ubuntu

Tidy

Referências · 32

• 🔥 https://github.com/htacg/tidy-html5/issues/217#issuecomment-108565501 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2015/07/13/7 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2015/06/04/2 · Exploit
• https://suse.com/security/cve/CVE-2015-5523 · Nota
• https://bugzilla.suse.com/933588 · Nota
• http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2015-5522 · Aviso do Fabricante
• http://securitytracker.com/id/1033703 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10210-1 · Aviso do Fabricante
• http://securityfocus.com/bid/75037 · Nota
• https://suse.com/security/cve/CVE-2016-6583 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-5523 · Nota de Segurança
• https://osv.dev/vulnerability/SUSE-SU-2015:1513-1 · Aviso do Fabricante
• http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html · Aviso do Fabricante
• https://bugzilla.suse.com/903962 · Nota