CVE-2017-13692

High

Published: 25/08/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

In Tidy 5.5.31, the IsURLCodePoint function in attrs.c allows attackers to cause a denial of service (Segmentation Fault) by using an invalid ISALNUM argument.

Risk Assessment

Attackers can exploit this vulnerability to disrupt application functionality, potentially leading to service outages.

Recommendation

It is recommended to update to the latest version of Tidy to mitigate this vulnerability.

Other vulnerabilities in Tidy 5.5.31

CVE-2017-17497High
In Tidy 5.7.0, the prvTidyTidyMetaCharset function in clean.c allows attackers to cause a denial of service (Segmentation Fault) because the currentNode variable is modified in the loop without validating the new value.

Original NVD description (English source)

In Tidy 5.5.31, the IsURLCodePoint function in attrs.c allows attackers to cause a denial of service (Segmentation Fault), as demonstrated by an invalid ISALNUM argument.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS