CVE-2009-3627

HTML-Parser < 3.63 - Denial of Service via Incomplete SGML Numeric Character Reference

Title source: llm
STIX 2.1

Description

The decode_entities function in util.c in HTML-Parser before 3.63 allows context-dependent attackers to cause a denial of service (infinite loop) via an incomplete SGML numeric character reference, which triggers generation of an invalid UTF-8 character.

References (8)

Core 8
Core References
Patch, Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/3022
Patch mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2009/10/23/9
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/53941
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=530604
Patch vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/36807
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/37155

Scores

EPSS 0.0173
EPSS Percentile 74.9%

Details

CWE
CWE-20
Status published
Products (10)
derrick_oswald/html-parser 1.00
derrick_oswald/html-parser 1.1
derrick_oswald/html-parser 1.2
derrick_oswald/html-parser 1.3
derrick_oswald/html-parser 1.4
derrick_oswald/html-parser 1.5
derrick_oswald/html-parser 1.6
derrick_oswald/html-parser 1.41
derrick_oswald/html-parser 1.42
derrick_oswald/html-parser < 3.54
Published Oct 29, 2009
Tracked Since Feb 18, 2026