{"id":"CVE-2015-5523","aliases":["DLA-273-1","DSA-3309-1","EUVD-2015-5478","GHSA-v5vg-qv4w-24wv","SUSE-SU-2015:1513-1","SUSE-SU-2015:1525-1","UBUNTU-CVE-2015-5523","USN-2695-1","openSUSE-SU-2024:10210-1"],"status":"published","title":"The ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a...","description":"The ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving multiple whitespace characters before an empty href, which triggers a large memory allocation.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.03842,"percentile":0.90189,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2015-07-16T00:00:00Z","modified":"2026-06-17T00:29:16Z","fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"tidy","fixed_in":["20091223cvs-1.2ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:6.0","package":"tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20091223cvs-1+deb6u1"}]}],"versions":["20091223cvs-1"],"bundled":2},{"source":"osv","ecosystem":"Debian:7","package":"tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20091223cvs-1.2+deb7u1"}]}],"versions":["20091223cvs-1.2"],"bundled":2},{"source":"osv","ecosystem":"Debian:8","package":"tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20091223cvs-1.4+deb8u1"}]}],"versions":["20091223cvs-1.4"],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.20100204cvs-25.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP3","package":"tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0-37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0-37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP3","package":"tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0-37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0-37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20091223cvs-1.2ubuntu1.1"}]}],"versions":["20091223cvs-1.2","20091223cvs-1.2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20091223cvs-1.2ubuntu1.1"}]}],"versions":["20091223cvs-1.2","20091223cvs-1.2ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-2.3"}]}],"bundled":3}],"products":[{"vendor":"apple","product":"iphone_os"},{"vendor":"apple","product":"mac_os_x"},{"vendor":"apple","product":"watchos"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"htacg","product":"tidy"}],"references":[{"url":"http://www.securitytracker.com/id/1033703","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2015/07/13/7","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit"]},{"url":"https://support.apple.com/HT205212","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2015/06/04/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","report"]},{"url":"http://www.ubuntu.com/usn/USN-2695-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory"]},{"url":"https://support.apple.com/HT205267","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"http://www.debian.org/security/2015/dsa-3309","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://github.com/htacg/tidy-html5/issues/217#issuecomment-108565501","tags":["x_refsource_CONFIRM","x_transferred","Exploit"]},{"url":"https://support.apple.com/HT205213","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/75037","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2015/07/15/3","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5523"},{"url":"https://github.com/advisories/GHSA-v5vg-qv4w-24wv"},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151513-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/903962","tags":["report"]},{"url":"https://bugzilla.suse.com/933588","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5523","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151525-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-5523","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2695-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5523","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5522","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6583","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-5523","description":"The ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving multiple whitespace characters before an empty href, which triggers a large memory allocation.","status":"published","published":"2015-08-11T14:00:00Z","modified":"2024-08-06T06:50:02.823Z","updated_at":"2026-11-02T14:35:40.217028Z"}],"euvd":[{"id":"EUVD-2015-5478","description":"The ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving multiple whitespace characters before an empty href, which triggers a large memory allocation.","status":"published","published":"2015-08-11T14:00:00Z","modified":"2024-08-06T06:50:02Z","updated_at":"2026-11-03T02:21:59.884926Z"}],"ghsa":[{"id":"GHSA-v5vg-qv4w-24wv","title":"The ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a...","description":"The ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving multiple whitespace characters before an empty href, which triggers a large memory allocation.","status":"published","published":"2022-05-17T03:22:37Z","modified":"2023-01-27T05:08:03Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:43:14.514072Z"}],"nvd":[{"id":"CVE-2015-5523","description":"The ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving multiple whitespace characters before an empty href, which triggers a large memory allocation.","status":"published","published":"2015-08-11T14:59:15.43Z","modified":"2026-06-17T00:29:16.44Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:07.96297Z"}],"osv":[{"id":"DLA-273-1","title":"tidy - security update","status":"published","published":"2015-07-18T00:00:00Z","modified":"2026-03-09T01:20:55.031485Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-3309-1","title":"tidy - security update","status":"published","published":"2015-07-18T00:00:00Z","modified":"2026-03-09T01:22:26.601943Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"openSUSE-SU-2024:10210-1","title":"libtidy-devel-5.2.0-2.3 on GA media","description":"These are all security issues fixed in the libtidy-devel-5.2.0-2.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:53:09.157985Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2015:1513-1","title":"Security update for tidy","description":"\nThis update fixes two heap-based buffer overflows in tidy/libtidy. These vulnerabilities\ncould allow remote attackers to cause a denial of service (crash) via vectors involving\na command character in an href. (CVE-2015-5522, CVE-2015-5523)\n","status":"published","published":"2015-08-26T20:03:54Z","modified":"2026-02-04T04:28:06.186272Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2015:1525-1","title":"Security update for tidy","description":"\nThis update fixes two heap-based buffer overflows in tidy/libtidy. These vulnerabilities\ncould allow remote attackers to cause a denial of service (crash) via vectors involving\na command character in an href. (CVE-2015-5522, CVE-2015-5523)\n","status":"published","published":"2015-08-26T20:04:21Z","modified":"2026-02-04T02:41:50.677698Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"UBUNTU-CVE-2015-5523","description":"The ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving multiple whitespace characters before an empty href, which triggers a large memory allocation.","status":"published","published":"2015-07-16T00:00:00Z","modified":"2026-04-22T10:13:44.252166Z","updated_at":"2026-11-02T15:54:10.385269Z"},{"id":"USN-2695-1","title":"tidy vulnerabilities","description":"Fernando Muñoz discovered that HTML Tidy incorrectly handled memory. If a\nuser or automated system were tricked into processing specially crafted\ndata, applications linked against HTML Tidy could be made to crash, leading\nto a denial of service, or possibly execute arbitrary code.\n","status":"published","published":"2015-07-29T18:24:15Z","modified":"2026-04-22T09:15:00.241005Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}