Ubuntu 23.10 USN-6483-1 Critical: HTML Tidy Remote Code Execution

ubuntu

November 15, 2023

tidy-html5 could be made to crash or run programs if it opened a specially crafted file.

Summary

tidy-html5 could be made to crash or run programs if it opened a specially

crafted file.

Software Description:

- tidy-html5: HTML/XML syntax checker and reformatter

Details:

Neeraj Pal discovered that HTML Tidy incorrectly handled parsing certain

HTML data. If a user or automated system were tricked into parsing

specially crafted HTML data, a remote attacker could cause HTML Tidy to

consume resources, leading to a denial of service, or possibly execute

arbitrary code.

Topics Covered

security advisory denial of service update critical remote code execution ubuntu html tidy

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
   libtidy5deb1                    2:5.6.0-11ubuntu0.23.10.1
   tidy                            2:5.6.0-11ubuntu0.23.10.1

Ubuntu 23.04:
   libtidy5deb1                    2:5.6.0-11ubuntu0.23.04.1
   tidy                            2:5.6.0-11ubuntu0.23.04.1

Ubuntu 22.04 LTS:
   libtidy5deb1                    2:5.6.0-11ubuntu0.22.04.1
   tidy                            2:5.6.0-11ubuntu0.22.04.1

Ubuntu 20.04 LTS:
   libtidy5deb1                    2:5.6.0-11ubuntu0.20.04.1
   tidy                            2:5.6.0-11ubuntu0.20.04.1

In general, a standard system update will make all the necessary changes.