CVE-2018-17075

2018-09-1600:00:00

ubuntu.com

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.004

Percentile

72.6%

JSON

The html package (aka x/net/html) before 2018-07-13 in Go mishandles “in
frameset” insertion mode, leading to a “panic: runtime error” for
html.Parse of <template><object>, <template><applet>, or
<template><marquee>. This is related to HTMLTreeBuilder.cpp in WebKit.

Bugs

Notes

Author	Note
mdeslaur	Packages built using golang need to be rebuilt once the vulnerability has been fixed. This CVE entry does not list packages that need rebuilding outside of the main repository or the Ubuntu variants with PPA overlays. introduced by https://github.com/golang/net/commit/500e7a4f953ddaf55d316b4d3adc516aa0379622