{"id":"CVE-2015-5522","aliases":["DLA-273-1","DSA-3309-1","EUVD-2015-5477","GHSA-wp28-phrj-p6rh","SUSE-SU-2015:1513-1","SUSE-SU-2015:1525-1","UBUNTU-CVE-2015-5522","USN-2695-1","openSUSE-SU-2024:10210-1"],"status":"published","title":"Heap-based buffer overflow in the ParseValue function in lexer.c in tidy before 4.9.31 allows...","description":"Heap-based buffer overflow in the ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving a command character in an href.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.04634,"percentile":0.91767,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2015-07-16T00:00:00Z","modified":"2026-06-17T00:29:16Z","fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"tidy","fixed_in":["20091223cvs-1.2ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:6.0","package":"tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20091223cvs-1+deb6u1"}]}],"versions":["20091223cvs-1"],"bundled":2},{"source":"osv","ecosystem":"Debian:7","package":"tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20091223cvs-1.2+deb7u1"}]}],"versions":["20091223cvs-1.2"],"bundled":2},{"source":"osv","ecosystem":"Debian:8","package":"tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20091223cvs-1.4+deb8u1"}]}],"versions":["20091223cvs-1.4"],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.20100204cvs-25.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP3","package":"tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0-37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0-37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP3","package":"tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0-37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0-37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20091223cvs-1.2ubuntu1.1"}]}],"versions":["20091223cvs-1.2","20091223cvs-1.2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20091223cvs-1.2ubuntu1.1"}]}],"versions":["20091223cvs-1.2","20091223cvs-1.2ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-2.3"}]}],"bundled":3}],"products":[{"vendor":"apple","product":"iphone_os"},{"vendor":"apple","product":"mac_os_x"},{"vendor":"apple","product":"watchos"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"htacg","product":"tidy"}],"references":[{"url":"http://www.securitytracker.com/id/1033703","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2015/07/13/7","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit"]},{"url":"https://support.apple.com/HT205212","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2015/06/04/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","report"]},{"url":"http://www.ubuntu.com/usn/USN-2695-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory"]},{"url":"https://support.apple.com/HT205267","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"http://www.debian.org/security/2015/dsa-3309","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://github.com/htacg/tidy-html5/issues/217","tags":["x_refsource_CONFIRM","x_transferred","Exploit"]},{"url":"https://support.apple.com/HT205213","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/75037","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2015/07/15/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5522"},{"url":"https://github.com/advisories/GHSA-wp28-phrj-p6rh"},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151513-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/903962","tags":["report"]},{"url":"https://bugzilla.suse.com/933588","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5523","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151525-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-5522","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2695-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5522","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5523","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6583","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-5522","description":"Heap-based buffer overflow in the ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving a command character in an href.","status":"published","published":"2015-08-11T14:00:00Z","modified":"2024-08-06T06:50:02.662Z","updated_at":"2026-11-02T14:35:39.846011Z"}],"euvd":[{"id":"EUVD-2015-5477","description":"Heap-based buffer overflow in the ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving a command character in an href.","status":"published","published":"2015-08-11T14:00:00Z","modified":"2024-08-06T06:50:02Z","updated_at":"2026-11-03T02:21:59.884926Z"}],"ghsa":[{"id":"GHSA-wp28-phrj-p6rh","title":"Heap-based buffer overflow in the ParseValue function in lexer.c in tidy before 4.9.31 allows...","description":"Heap-based buffer overflow in the ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving a command character in an href.","status":"published","published":"2022-05-17T03:22:38Z","modified":"2023-01-27T05:06:50Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:42:59.735626Z"}],"nvd":[{"id":"CVE-2015-5522","description":"Heap-based buffer overflow in the ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving a command character in an href.","status":"published","published":"2015-08-11T14:59:14.307Z","modified":"2026-06-17T00:29:16.283Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:07.96297Z"}],"osv":[{"id":"DLA-273-1","title":"tidy - security update","status":"published","published":"2015-07-18T00:00:00Z","modified":"2026-03-09T01:20:55.031485Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-3309-1","title":"tidy - security update","status":"published","published":"2015-07-18T00:00:00Z","modified":"2026-03-09T01:22:26.601943Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"openSUSE-SU-2024:10210-1","title":"libtidy-devel-5.2.0-2.3 on GA media","description":"These are all security issues fixed in the libtidy-devel-5.2.0-2.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:53:09.157985Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2015:1513-1","title":"Security update for tidy","description":"\nThis update fixes two heap-based buffer overflows in tidy/libtidy. These vulnerabilities\ncould allow remote attackers to cause a denial of service (crash) via vectors involving\na command character in an href. (CVE-2015-5522, CVE-2015-5523)\n","status":"published","published":"2015-08-26T20:03:54Z","modified":"2026-02-04T04:28:06.186272Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2015:1525-1","title":"Security update for tidy","description":"\nThis update fixes two heap-based buffer overflows in tidy/libtidy. These vulnerabilities\ncould allow remote attackers to cause a denial of service (crash) via vectors involving\na command character in an href. (CVE-2015-5522, CVE-2015-5523)\n","status":"published","published":"2015-08-26T20:04:21Z","modified":"2026-02-04T02:41:50.677698Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"UBUNTU-CVE-2015-5522","description":"Heap-based buffer overflow in the ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving a command character in an href.","status":"published","published":"2015-07-16T00:00:00Z","modified":"2026-04-22T10:14:13.49852Z","updated_at":"2026-11-02T15:54:10.385269Z"},{"id":"USN-2695-1","title":"tidy vulnerabilities","description":"Fernando Muñoz discovered that HTML Tidy incorrectly handled memory. If a\nuser or automated system were tricked into processing specially crafted\ndata, applications linked against HTML Tidy could be made to crash, leading\nto a denial of service, or possibly execute arbitrary code.\n","status":"published","published":"2015-07-29T18:24:15Z","modified":"2026-04-22T09:15:00.241005Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}