CVE-2015-5522 Heap-based buffer overflow in the ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving a command character in an href...
MediumCVSS 6.8
EPSS 4.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Heap-based buffer overflow in the ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving a command character in an href.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| htacg tidy | <= 4.9.30 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 15.04 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| apple iphone os | <= 8.2 | No fix listed |
| apple mac os x | <= 10.6.8 | No fix listed |
| apple watchOS | <= 1.0.1 | No fix listed |
References
- APPLE-SA-2015-09-16-1 mailing-list third-party-advisory vendor-advisory
- APPLE-SA-2015-09-21-1 mailing-list third-party-advisory vendor-advisory
- APPLE-SA-2015-09-30-3 mailing-list third-party-advisory vendor-advisory
- DSA-3309 third-party-advisory vendor-advisory
- [oss-security] 20150604 CVE Request - tidy 0.99 / tidy5 heap-buffer-overflow exploit mailing-list
- [oss-security] 20150713 Re: CVE Request - tidy 0.99 / tidy5 heap-buffer-overflow exploit mailing-list
- [oss-security] 20150714 Re: CVE Request - tidy 0.99 / tidy5 heap-buffer-overflow exploit mailing-list
- 75037 vdb-entry
- 1033703 vdb-entry
- USN-2695-1 third-party-advisory vendor-advisory
- github.com exploit
- support.apple.com third-party-advisory
- support.apple.com third-party-advisory
- support.apple.com third-party-advisory