[<prev] [next>] [day] [month] [year] [list]
Message-ID: <4AE1FD20.6070802@redhat.com>
Date: Fri, 23 Oct 2009 20:59:44 +0200
From: Jan Lieskovsky <jlieskov@...hat.com>
To: "Steven M. Christey" <coley@...us.mitre.org>
CC: oss-security <oss-security@...ts.openwall.com>
Subject: CVE-2009-3627 assignment notification - HTML-Parser-3.63
Hello Steve, vendors,
Mark Martinec reported a denial of service flaw ((infinite loop),
present in HTML-Parser in versions prior to 3.63, while parsing
HTML entity with invalid UTF-8 character.
References:
-----------
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6225
http://search.cpan.org/CPAN/authors/id/G/GA/GAAS/HTML-Parser-3.63.tar.gz
Upstream patch:
---------------
http://github.com/gisle/html-parser/commit/b9aae1e43eb2c8e989510187cff0ba3e996f9a4c
Affected versions:
------------------
Issue was confirmed in 3.55 version of perl HTML-Parser module.
CVE identifier:
---------------
CVE identifier of CVE-2009-3627 has been already assigned to this issue.
Thanks && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
