TI-2025-05899 CVE-2025-6498 · GHSA-449v-6j3r-mxhj
HTACG tidy-html5 alloc.c defaultAlloc memory leak
Priority MEDIUM 55
A vulnerability classified as problematic has been found in HTACG tidy-html5 5.8.0.
Vulnerabilities
8 records
TI-2025-05898 CVE-2025-6497 · GHSA-2843-f6r8-wh6v
HTACG tidy-html5 parser.c prvTidyParseNamespace assertion
Priority MEDIUM 55
A vulnerability was found in HTACG tidy-html5 5.8.0.
TI-2025-05897 CVE-2025-6496 · GHSA-8cw2-hw77-mrmj
HTACG tidy-html5 parser.c InsertNodeAsParent null pointer dereference
Priority MEDIUM 55
A vulnerability was found in HTACG tidy-html5 5.8.0.
TI-2021-12836 CVE-2021-33391 · GHSA-wfrp-xv2m-8j85
An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g…
Priority HIGH 82
An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c.
TI-2017-12775 CVE-2017-17497 · GHSA-xj89-pr57-g8p3
In Tidy 5.7.0, the prvTidyTidyMetaCharset function in clean.c allows attackers to cause a…
Priority LOW 36
In Tidy 5.7.0, the prvTidyTidyMetaCharset function in clean.c allows attackers to cause a denial of service (Segmentation Fault), because the currentNode variable in the "children of the head" processing feature is modif…
TI-2017-09969 CVE-2017-13692 · GHSA-p4rg-78qv-f5g4
In Tidy 5.5.31, the IsURLCodePoint function in attrs.c allows attackers to cause a denial…
Priority LOW 35
In Tidy 5.5.31, the IsURLCodePoint function in attrs.c allows attackers to cause a denial of service (Segmentation Fault), as demonstrated by an invalid ISALNUM argument.
TI-2015-04651 CVE-2015-5523 · GHSA-v5vg-qv4w-24wv
The ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause…
Priority LOW 27
The ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving multiple whitespace characters before an empty href, which triggers a large memo…
TI-2015-04650 CVE-2015-5522 · GHSA-wp28-phrj-p6rh
Heap-based buffer overflow in the ParseValue function in lexer.c in tidy before 4.9.31…
Priority LOW 38
Heap-based buffer overflow in the ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving a command character in an href.