All errata/sisyphus/ALT-PU-2017-2636-1
ALT-PU-2017-2636-1

Package update tidy in branch sisyphus

Version5.4-alt1.20170301
Task#194482
Published2017-11-13
Max severityMEDIUM
Severity:

Closed issues (2)

CVE-2015-5522
MEDIUM6.8

Heap-based buffer overflow in the ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving a command character in an href.

Published: 2015-08-11Modified: 2025-04-12
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P
References
CVE-2015-5523
MEDIUM4.3

The ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving multiple whitespace characters before an empty href, which triggers a large memory allocation.

Published: 2015-08-11Modified: 2025-04-12
CVSS 2.0MEDIUM 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:P
References