Debian 5.0 DSA-1923-1 Critical: libhtml-parser-perl Denial of Service

A denial of service vulnerability has been found in libhtml-parser-perl,
a collection of modules to parse HTML in text documents which is used by
several other projects like e.g. SpamAssassin.

Mark Martinec discovered that the decode_entities() function will get stuck
in an infinite loop when parsing certain HTML entities with invalid UTF-8
characters. An attacker can use this to perform denial of service attacks
by submitting crafted HTML to an application using this functionality.


For the oldstable distribution (etch), this problem has been fixed in
version 3.55-1+etch1.

For the stable distribution (lenny), this problem has been fixed in
version 3.56-1+lenny1.

For the testing (squeeze) and unstable (sid) distribution, this problem
will be fixed soon.


We recommend that you upgrade your libhtml-parser-perl packages.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package man...