CVE-2015-5522: Buffer Overflow
Published Aug 11, 2015
·Updated
Heap-based buffer overflow in the ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving a command character in an href.
Affected Software
9 affected components
HTACG Tidy<=4.9.30
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=15.04
Debian Debian Linux=7.0
Debian Debian Linux=8.0
Apple iPhone OS<=8.2
Apple iOS and macOS<=10.6.8
Apple WatchOS<=1.0.1
Event History
Aug 11, 2015
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-5522?
CVE-2015-5522 is classified as a high-severity vulnerability due to its potential to cause remote denial of service.
2
How do I fix CVE-2015-5522?
To fix CVE-2015-5522, update to Tidy version 4.9.31 or later.
3
What systems are affected by CVE-2015-5522?
CVE-2015-5522 affects Tidy versions prior to 4.9.31 and various versions of Ubuntu, Debian, Apple iOS, macOS, and watchOS.
4
What type of vulnerability is CVE-2015-5522?
CVE-2015-5522 is a heap-based buffer overflow vulnerability.
5
What causes the vulnerability in CVE-2015-5522?
CVE-2015-5522 is caused by improper handling of command characters in an href within the ParseValue function.