CVE-2018-17847: Buffer Overflow
The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a panic: runtime error (index out of range) in (nodeStack).pop in node.go, called from (parser).clearActiveFormattingElements, during an html.Parse call.
Other sources
The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out of range) in (nodeStack).pop in node.go, called from (parser).clearActiveFormattingElements, during an html.Parse call.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-17847?
CVE-2018-17847 has a medium severity due to its ability to cause a panic in the Go HTML parser.
How do I fix CVE-2018-17847?
To fix CVE-2018-17847, update the x/net/html package to version 0.0.0-20190125002852-4b62a64f59f7 or later.
What versions of Go are affected by CVE-2018-17847?
CVE-2018-17847 affects versions of the Go x/net/html package prior to the fix released on 2019-01-25.
What impact does CVE-2018-17847 have on applications?
Applications using the affected versions of the Go html package may crash if they encounter specific SVG elements during parsing.
Is CVE-2018-17847 specifically tied to any operating systems?
CVE-2018-17847 primarily affects the Go programming environment and may also impact applications running on Fedora 28 and 29.