CVEvulnerability

CVE-2009-3627

4.3 MEDIUM Published 2009-10-29 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2009-10-29
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:N/A:P
Weaknesses
CWE-20

Description

The decode_entities function in util.c in HTML-Parser before 3.63 allows context-dependent attackers to cause a denial of service (infinite loop) via an incomplete SGML numeric character reference, which triggers generation of an invalid UTF-8 character.

Affected configurations

• derrick oswald html-parser (<= 3.54) • derrick oswald html-parser 1.00 • derrick oswald html-parser 1.1 • derrick oswald html-parser 1.2 • derrick oswald html-parser 1.3 • derrick oswald html-parser 1.4 • derrick oswald html-parser 1.5 • derrick oswald html-parser 1.6 • derrick oswald html-parser 1.41 • derrick oswald html-parser 1.42

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References