The decode_entities function in util.c in HTML-Parser before 3.63 allows context-dependent attackers to cause a denial of service (infinite loop) via an incomplete SGML numeric character reference, which triggers generation of an invalid UTF-8 character.

Specially crafted HTML documents could cause perl-HTML-Parser to run into an endless loop. (CVE-2009-3627)

A denial of service vulnerability has been found in libhtml-parser-perl, a collection of modules to parse HTML in text documents which is used by several other projects like e.g.
SpamAssassin.

Mark Martinec discovered that the decode_entities() function will get stuck in an infinite loop when parsing certain HTML entities with invalid UTF-8 characters. An attacker can use this to perform denial of service attacks by submitting crafted HTML to an application using this functionality.

Specially crafted HTML documents could cause perl-HTML-Parser to run into an endless loop (CVE-2009-3627).

CVE reports :

The decode_entities function in util.c in HTML-Parser before 3.63 allows context-dependent attackers to cause a denial of service (infinite loop) via an incomplete SGML numeric character reference, which triggers generation of an invalid UTF-8 character.

Mark Martinec discovered that HTML::Parser incorrectly handled strings with incomplete entities. An attacker could send specially crafted input to applications that use HTML::Parser and cause a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
49915	SuSE 10 Security Update : perl-HTML-Parser (ZYPP Patch Number 6622)	Nessus	SuSE Local Security Checks	medium
44788	Debian DSA-1923-1 : libhtml-parser-perl - denial of service	Nessus	Debian Local Security Checks	medium
43086	SuSE 10 Security Update : perl-HTML-Parser (ZYPP Patch Number 6621)	Nessus	SuSE Local Security Checks	medium
43084	SuSE 11 Security Update : perl-HTML-Parser (SAT Patch Number 1495)	Nessus	SuSE Local Security Checks	medium
43083	openSUSE Security Update : perl-HTML-Parser (perl-HTML-Parser-1491)	Nessus	SuSE Local Security Checks	medium
43082	openSUSE Security Update : perl-HTML-Parser (perl-HTML-Parser-1491)	Nessus	SuSE Local Security Checks	medium
42414	FreeBSD : p5-HTML-Parser -- denial of service (68bda678-caab-11de-a97e-be89dfd1042e)	Nessus	FreeBSD Local Security Checks	medium
42408	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : libhtml-parser-perl vulnerability (USN-855-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2009-3627

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium