CVE-2016-9909 Improper Neutralization of Input During Web Page Generation in html5lib
MediumCVSS 6.1
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS) attacks by leveraging mishandling of the < (less than) character in attribute values.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi html5lib(PyPI) | < 0.999999999 | 0.999999999 |
| pypi html5lib(PyPI) | = 0.10 | No fix listed |
| pypi html5lib(PyPI) | = 0.11 | No fix listed |
| pypi html5lib(PyPI) | = 0.11.1 | No fix listed |
| pypi html5lib(PyPI) | = 0.2 | No fix listed |
| pypi html5lib(PyPI) | = 0.9 | No fix listed |
| pypi html5lib(PyPI) | = 0.90 | No fix listed |
| pypi html5lib(PyPI) | = 0.95 | No fix listed |
| pypi html5lib(PyPI) | = 0.99 | No fix listed |
| pypi html5lib(PyPI) | = 0.999 | No fix listed |
| pypi html5lib(PyPI) | = 0.9999 | No fix listed |
| pypi html5lib(PyPI) | = 0.99999 | No fix listed |
| pypi html5lib(PyPI) | = 0.999999 | No fix listed |
| pypi html5lib(PyPI) | = 0.9999999 | No fix listed |
| pypi html5lib(PyPI) | = 0.99999999 | No fix listed |
| debian/html5lib(Debian:12) | < 0.999999999-1 | 0.999999999-1 |
| debian/html5lib(Debian:13) | < 0.999999999-1 | 0.999999999-1 |
| debian/html5lib(Debian:14) | < 0.999999999-1 | 0.999999999-1 |
| html5lib | <= 0.99999999 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking vendor-advisory
- github.com issue-tracking vendor-advisory
- github.com patch
- github.com vendor-advisory
- github.com product
- github.com
- html5lib.readthedocs.io release-notes
- web.archive.org
- [oss-security] 20161206 CVE Request: html5lib: potential cross-site scripting vulnerablity: quote attributes that need escaping in legacy browsers mailing-list patch third-party-advisory
- [oss-security] 20161208 Re: CVE Request: html5lib: potential cross-site scripting vulnerablity: quote attributes that need escaping in legacy browsers mailing-list patch third-party-advisory
- 95132 third-party-advisory vdb-entry
- Debian Security Tracker CVE-2016-9909 vendor-advisory