PT-2007-4572 · Html Tidy+1 · Libtidy+1

Rgod · Published 2007-06-20 · Updated 2017-10-11 · CVE-2007-3294

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Tidy extension for PHP version 5.2.3

Description The issue is related to multiple buffer overflows in libtidy, which can be exploited by context-dependent attackers to execute arbitrary code. This can be achieved through a long second argument to the tidy parse string function or an unspecified vector to the tidy repair string function. The problem might be specific to environments where vsnprintf is implemented as a wrapper for vsprintf.

Recommendations For Tidy extension for PHP version 5.2.3, consider restricting the input to the tidy parse string and tidy repair string functions to prevent buffer overflows until a patch is available. As a temporary workaround, avoid using the tidy parse string and tidy repair string functions with untrusted input.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2007-3294

Affected Products

Tidy Extension For Php

Libtidy

References · 6

• 🔥 https://exploit-db.com/exploits/4080 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-3294 · Security Note
• http://secunia.com/advisories/25735 · Vendor Advisory
• http://osvdb.org/36853 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3294 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34931 · Note