Skip to content
OpenAdvisories
Unscored USN-2695-1 2 CVEs

tidy vulnerabilities

Published Jul 29, 2015 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

Fernando Muñoz discovered that HTML Tidy incorrectly handled memory. If a
user or automated system were tricked into processing specially crafted
data, applications linked against HTML Tidy could be made to crash, leading
to a denial of service, or possibly execute arbitrary code.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS tidy 20091223cvs-1.2ubuntu1.1

Vulnerabilities 2

  • Unscored —
    CVE-2015-5522

    Heap-based buffer overflow in the ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause…

    tidy Ubuntu
  • Unscored —
    CVE-2015-5523

    The ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) v…

    tidy Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2015-5522
  • report
    https://ubuntu.com/security/CVE-2015-5523