CVE-2017-17497

High

Published: 10/12/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

In Tidy 5.7.0, the prvTidyTidyMetaCharset function in clean.c allows attackers to cause a denial of service (Segmentation Fault) because the currentNode variable is modified in the loop without validating the new value.

Risk Assessment

An attacker can exploit this vulnerability to trigger application crashes, potentially leading to service downtime.

Recommendation

It is recommended to upgrade to a newer version of Tidy where the issue has been fixed to minimize the risk of denial of service.

Other vulnerabilities in Tidy 5.7.0

CVE-2017-13692High
In Tidy 5.5.31, the IsURLCodePoint function in attrs.c allows attackers to cause a denial of service (Segmentation Fault) by using an invalid ISALNUM argument.

Original NVD description (English source)

In Tidy 5.7.0, the prvTidyTidyMetaCharset function in clean.c allows attackers to cause a denial of service (Segmentation Fault), because the currentNode variable in the "children of the head" processing feature is modified in the loop without validating the new value.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS