Description
Cross-site scripting (XSS) vulnerability in ht://dig (htdig) before 3.1.6-r7 allows remote attackers to execute arbitrary web script or HTML via the config parameter, which is not properly sanitized before it is displayed in an error message.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | htdig | 1:3.1.6-11 | — |
| Debian 13 | htdig | 1:3.1.6-11 | — |
| Debian 12 | htdig | 1:3.1.6-11 | — |
| Debian 3.0 | htdig | 3.1.6-3woody1 | DSA-680-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | htdig +1 | 3:3.2.0b6-3.40.1 | RHSA-2005:090 |
Advisories 2
- RHSA-2005:090 Red Hat Security Advisory: htdig security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-680-1 htdig - unsanitised input Debian Security (DSA / DLA) · Mar 9, 2026
References
- 14795 third-party-advisory
- oval:org.mitre.oval:def:10878 vdb-entry signature
- RHSA-2005:073 vendor-advisory
- 14255 third-party-advisory
- MDKSA-2005:063 vendor-advisory
- 17415 third-party-advisory
- htdig-config-xss(19223) vdb-entry
- 14303 third-party-advisory
- 14276 third-party-advisory
- 12442 vdb-entry
- GLSA-200502-16 vendor-advisory
- DSA-680 vendor-advisory
- 17414 third-party-advisory
- RHSA-2005:090 vendor-advisory
- FLSA-2006:152907 vendor-advisory
- 15007 third-party-advisory
- 1013078 vdb-entry