CVE-2009-3627
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
6.1 Medium
AI Score
Confidence
Low
0.002 Low
EPSS
Percentile
60.9%
The decode_entities function in util.c in HTML-Parser before 3.63 allows context-dependent attackers to cause a denial of service (infinite loop) via an incomplete SGML numeric character reference, which triggers generation of an invalid UTF-8 character.
Affected configurations
References
github.com/gisle/html-parser/commit/b9aae1e43eb2c8e989510187cff0ba3e996f9a4c
secunia.com/advisories/37155
www.openwall.com/lists/oss-security/2009/10/23/9
www.securityfocus.com/bid/36807
www.vupen.com/english/advisories/2009/3022
bugzilla.redhat.com/show_bug.cgi?id=530604
exchange.xforce.ibmcloud.com/vulnerabilities/53941
issues.apache.org/SpamAssassin/show_bug.cgi?id=6225
Related
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
6.1 Medium
AI Score
Confidence
Low
0.002 Low
EPSS
Percentile
60.9%