Summary
Neeraj Pal discovered that HTML Tidy incorrectly handled parsing certain
HTML data. If a user or automated system were tricked into parsing
specially crafted HTML data, a remote attacker could cause HTML Tidy to
consume resources, leading to a denial of service, or possibly execute
arbitrary code.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | tidy-html5 | 2:5.6.0-11ubuntu0.20.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | tidy-html5 | 2:5.6.0-11ubuntu0.22.04.1 |
Vulnerabilities 1
-
Critical 9.8
An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() func…
References
-
report
https://ubuntu.com/security/CVE-2021-33391