CVE-2015-5523: Buffer Overflow
The ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving multiple whitespace characters before an empty href, which triggers a large memory allocation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5523?
CVE-2015-5523 is classified as a denial of service vulnerability that can lead to a system crash.
How do I fix CVE-2015-5523?
To mitigate CVE-2015-5523, upgrade to Tidy version 4.9.31 or later, which addresses the vulnerability.
What software is affected by CVE-2015-5523?
CVE-2015-5523 affects various versions of Ubuntu, Debian, macOS, and Apple iPhone OS that utilize Tidy prior to version 4.9.31.
What kind of attack does CVE-2015-5523 enable?
CVE-2015-5523 allows remote attackers to perform a denial of service attack by triggering excessive memory allocation.
Can CVE-2015-5523 affect my web applications?
Yes, if your web applications use the vulnerable version of Tidy, they could be susceptible to exploitation through crafted inputs.