Lucene search

K

GoogleOSV:GHSA-5P4H-3377-7W67

HistoryMay 13, 2022 - 1:19 a.m.

golang.org/x/net/html NULL Pointer Dereference vulnerability

2022-05-1301:19:22

Google

osv.dev

9

golang webkit software vulnerability runtime error frameset html package htmltreebuilder.cpp noreferrer 2018-07-13 go mishandles panic objects applet marquee .

EPSS

0.004

Percentile

72.6%

The html package (aka x/net/html) before 2018-07-13 in Go mishandles “in frameset” insertion mode, leading to a “panic: runtime error” for html.Parse of <template><object>, <template><applet>, or <template><marquee>. This is related to HTMLTreeBuilder.cpp in WebKit.

References

bugs.chromium.org/p/chromium/issues/detail?id=829668

github.com/golang/go

github.com/golang/go/issues/27016

github.com/golang/net/commit/aaf60122140d3fcf75376d319f0554393160eb50

go-review.googlesource.com/c/net/+/94838/9/html/parse.go#1906

go.dev/cl/123776

go.dev/issue/27016

go.googlesource.com/net/+/aaf60122140d3fcf75376d319f0554393160eb50

lists.fedoraproject.org/archives/list/[email protected]/message/LREEWY6KNLHRWFZ7OT4HVLMVVCGGUHON

lists.fedoraproject.org/archives/list/[email protected]/message/UKRCI7WIOCOCD3H7NXWRGIRABTQOZOBK

nvd.nist.gov/vuln/detail/CVE-2018-17075

pkg.go.dev/vuln/GO-2021-0078

EPSS

0.004

Percentile

72.6%

Related for OSV:GHSA-5P4H-3377-7W67

gitlab2 prion1 ubuntucve1 debiancve1 redhatcve1 veracode1 osv2 nvd1 cve1 cvelist1 github1 fedora2 nessus1 openvas2 ibm1