PT-2026-46135 · Cpan · Html::Entities
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
HTML::Entities versions prior to 3.84
Description
The XS routine supporting
decode entities() caches a pointer (repl) to the entity-value SV returned by hv fetch on the entity2char hash. If the input SV is identical to a value SV in that hash and that value contains its own key as an entity reference, a subsequent call to grow gap() reallocates the SV's PV buffer. This action frees the backing allocation that repl still points to, causing the following copy loop to read repl len bytes from the freed memory. This can lead to the disclosure of adjacent heap contents into the destination SV.Recommendations
Update to version 3.84 or later.
Exploit
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Html::Entities