Specially crafted HTML documents could cause perl-HTML-Parser to run into an endless loop. (CVE-2009-3627)

特別に細工された HTML ドキュメントにより、perl-HTML-Parser が無限ループに陥る可能性があります。（CVE-2009-3627）

SpamAssassin 等、他のいくつかのプロジェクトで使用されている、テキストドキュメント内の HTML を解析するモジュールのコレクションである libhtml-parser-perl に、サービス拒否の
脆弱性が見つかりました。

Mark Martinec 氏は、無効な UTF-8 文字を含む特定の HTML エンティティを解析する際、decode_entities() 関数が無限ループに陥ることを発見しました。攻撃者がこれを利用して、この機能を使用するアプリケーションに細工された HTML を送信することにより、DoS 攻撃（サービス拒否攻撃）を行う可能性があります。

Mark Martinec discovered that HTML::Parser incorrectly handled strings with incomplete entities. An attacker could send specially crafted input to applications that use HTML::Parser and cause a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A denial of service vulnerability has been found in libhtml-parser-perl, a collection of modules to parse HTML in text documents which is used by several other projects like e.g.
SpamAssassin.

Mark Martinec discovered that the decode_entities() function will get stuck in an infinite loop when parsing certain HTML entities with invalid UTF-8 characters. An attacker can use this to perform denial of service attacks by submitting crafted HTML to an application using this functionality.

CVE reports :

The decode_entities function in util.c in HTML-Parser before 3.63 allows context-dependent attackers to cause a denial of service (infinite loop) via an incomplete SGML numeric character reference, which triggers generation of an invalid UTF-8 character.

Specially crafted HTML documents could cause perl-HTML-Parser to run into an endless loop (CVE-2009-3627).

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
43086	SuSE 10 Security Update : perl-HTML-Parser (ZYPP Patch Number 6621)	Nessus	SuSE Local Security Checks	2009/12/9	2021/1/14	medium
49915	SuSE 10 セキュリティ更新：perl-HTML-Parser（ZYPP パッチ番号 6622）	Nessus	SuSE Local Security Checks	2010/10/11	2021/1/14	medium
43084	SuSE 11 Security Update : perl-HTML-Parser (SAT Patch Number 1495)	Nessus	SuSE Local Security Checks	2009/12/9	2021/1/14	medium
44788	Debian DSA-1923-1：libhtml-parser-perl - サービス拒否	Nessus	Debian Local Security Checks	2010/2/24	2021/1/4	medium
42408	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : libhtml-parser-perl vulnerability (USN-855-1)	Nessus	Ubuntu Local Security Checks	2009/11/6	2021/1/19	medium
44788	Debian DSA-1923-1 : libhtml-parser-perl - denial of service	Nessus	Debian Local Security Checks	2010/2/24	2021/1/4	medium
49915	SuSE 10 Security Update : perl-HTML-Parser (ZYPP Patch Number 6622)	Nessus	SuSE Local Security Checks	2010/10/11	2021/1/14	medium
42414	FreeBSD : p5-HTML-Parser -- denial of service (68bda678-caab-11de-a97e-be89dfd1042e)	Nessus	FreeBSD Local Security Checks	2009/11/9	2021/1/6	medium
43082	openSUSE Security Update : perl-HTML-Parser (perl-HTML-Parser-1491)	Nessus	SuSE Local Security Checks	2009/12/9	2021/1/14	medium
43083	openSUSE Security Update : perl-HTML-Parser (perl-HTML-Parser-1491)	Nessus	SuSE Local Security Checks	2009/12/9	2021/1/14	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium