CVE-2015-5523
Fixed in a distro release EPSS 4%
The ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving multiple whitespace characters before an empty href, which triggers a large memory allocation.
Products: canonical ubuntu_linux, debian_linux, apple iphone_os, apple mac_os_x, apple watchos, htacg tidy
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 6.0 | tidy | 20091223cvs-1+deb6u1 |
| Debian 7 | tidy | 20091223cvs-1.2+deb7u1 |
| Debian 8 | tidy | 20091223cvs-1.4+deb8u1 |
| SUSE Linux Enterprise Desktop 11 SP3 | tidy | 1.0-37.1 |
| SUSE Linux Enterprise Desktop 11 SP4 | tidy | 1.0-37.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP3 | tidy | 1.0-37.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | tidy | 1.0-37.1 |
| SUSE Linux Enterprise Software Development Kit 12 | tidy | 1.0.20100204cvs-25.3 |
| Ubuntu 14.04 LTS | tidy | 20091223cvs-1.2ubuntu1.1 |
| openSUSE Tumbleweed | tidy | 5.2.0-2.3 |