The ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) via vectors involving multiple whitespace characters before an empty href, which triggers a large memory allocation.

The remote host is running a version of Mac OS X that is 10.6.8 or later but prior to 10.11 and is affected by multiple vulnerabilities in the following components : 

 - Address Book 
 - AirScan 
 - apache_mod_php 
 - Apple Online Store Kit 
 - AppleEvents 
 - Audio 
 - bash 
 - Certificate Trust Policy 
 - CFNetwork Cookies - CFNetwork FTPProtocol 
 - CFNetwork HTTPProtocol 
 - CFNetwork Proxies 
 - CFNetwork SSL 
 - CoreCrypto 
 - CoreText 
 - Dev Tools 
 - Disk Images 
 - dyld 
 - EFI 
 - Finder 
 - Game Center 
 - Heimdal 
 - ICU 
 - Install Framework Legacy 
 - Intel Graphics Driver 
 - IOAudioFamily 
 - IOGraphics 
 - IOHIDFamily 
 - IOStorageFamily 
 - Kernel 
 - libc 
 - libpthread 
 - libxpc 
 - Login Window 
 - lukemftpd 
 - Mail 
 - Multipeer Connectivity 
 - NetworkExtension 
 - Notes 
 - OpenSSH 
 - OpenSSL 
 - procmail 
 - remote_cmds 
 - removefile 
 - Ruby 
 - Safari 
 - Safari Downloads 
 - Safari Extensions 
 - Safari Safe Browsing 
 - Security 
 - SMB 
 - SQLite 
 - Telephony 
 - Terminal 
 - tidy 
 - Time Machine 
 - WebKit 
 - WebKit CSS 
 - WebKit JavaScript Bindings 
 - WebKit Page Loading 
 - WebKit Plug-ins

The remote host is running a version of iOS that is prior to version 9.0 and the following components contain vulnerabilities :

 - Apple Pay 
 - AppleKeyStore 
 - Application Store 
 - Audio 
 - Certificate Trust Policy 
 - CFNetwork 
 - CFNetwork Cookies 
 - CFNetwork FTPProtocol 
 - CFNetwork Proxies 
 - CFNetwork SSL 
 - CoreAnimation 
 - CoreCrypto 
 - CoreText 
 - Data Detectors Engine 
 - Dev Tools 
 - Disk Images 
 - dyld 
 - Game Center 
 - ICU 
 - IOAcceleratorFamily 
 - IOHIDFamily 
 - IOKit 
 - IOMobileFrameBuffer 
 - IOStorageFamily 
 - iTunes Store 
 - JavaScriptCore 
 - Kernel 
 - libc 
 - libpthread 
 - Mail 
 - Multipeer Connectivity 
 - NetworkExtension 
 - OpenSSL 
 - PluginKit 
 - removefile 
 - Safari 
 - Safari Safe Browsing 
 - Security 
 - Siri 
 - SpringBoard 
 - SQLite 
 - tidy 
 - WebKit 
 - WebKit Canvas 
 - WebKit Page Loading

The remote host is running a version of Mac OS X that is 10.6.8 or later but prior to 10.11. It is, therefore, affected by multiple vulnerabilities in the following components :

  - Address Book
  - AirScan
  - apache_mod_php
  - Apple Online Store Kit
  - AppleEvents
  - Audio
  - bash
  - Certificate Trust Policy
  - CFNetwork Cookies
  - CFNetwork FTPProtocol
  - CFNetwork HTTPProtocol
  - CFNetwork Proxies
  - CFNetwork SSL
  - CoreCrypto
  - CoreText
  - Dev Tools
  - Disk Images
  - dyld
  - EFI
  - Finder
  - Game Center
  - Heimdal
  - ICU
  - Install Framework Legacy
  - Intel Graphics Driver
  - IOAudioFamily
  - IOGraphics
  - IOHIDFamily
  - IOStorageFamily
  - Kernel
  - libc
  - libpthread
  - libxpc
  - Login Window
  - lukemftpd
  - Mail
  - Multipeer Connectivity
  - NetworkExtension
  - Notes
  - OpenSSH
  - OpenSSL
  - procmail
  - remote_cmds
  - removefile
  - Ruby
  - Safari
  - Safari Downloads
  - Safari Extensions
  - Safari Safe Browsing
  - Security
  - SMB
  - SQLite
  - Telephony
  - Terminal
  - tidy
  - Time Machine
  - WebKit
  - WebKit CSS
  - WebKit JavaScript Bindings
  - WebKit Page Loading
  - WebKit Plug-ins

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The mobile device is running a version of iOS prior to version 9.0. It is, therefore, affected by vulnerabilities in the following components :

  - Apple Pay
  - AppleKeyStore
  - Application Store
  - Audio
  - Certificate Trust Policy
  - CFNetwork
  - CFNetwork Cookies
  - CFNetwork FTPProtocol
  - CFNetwork Proxies
  - CFNetwork SSL
  - CommonCrypto 
  - CoreAnimation
  - CoreCrypto
  - CoreText
  - Data Detectors Engine
  - Dev Tools
  - Disk Images
  - dyld
  - Game Center
  - ICU
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit
  - IOMobileFrameBuffer
  - IOStorageFamily
  - iTunes Store
  - JavaScriptCore
  - Kernel
  - libc
  - libpthread
  - Mail
  - Multipeer Connectivity
  - NetworkExtension
  - OpenSSL
  - PluginKit
  - removefile
  - Safari
  - Safari Safe Browsing
  - Security
  - Siri
  - SpringBoard
  - SQLite
  - tidy
  - WebKit
  - WebKit Canvas
  - WebKit Page Loading

This update fixes two heap-based buffer overflows in tidy/libtidy.
These vulnerabilities could allow remote attackers to cause a denial of service (crash) via vectors involving a command character in an href. (CVE-2015-5522, CVE-2015-5523)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fernando Munoz discovered that HTML Tidy incorrectly handled memory.
If a user or automated system were tricked into processing specially crafted data, applications linked against HTML Tidy could be made to crash, leading to a denial of service, or possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fernando Munoz discovered that invalid HTML input passed to tidy, an HTML syntax checker and reformatter, could trigger a buffer overflow.
This could allow remote attackers to cause a denial of service (crash) or potentially execute arbitrary code.

Geoff McLane also discovered that a similar issue could trigger an integer overflow, leading to a memory allocation of 4GB. This could allow remote attackers to cause a denial of service by saturating the target's memory.

Fernando Mu&ntilde;oz discovered a security issue on the HTML syntax checker and reformatter tidy. Tidy did not properly process specific character sequences, and a remote attacker could exploit this flaw to cause a DoS, or probably, execute arbitrary code. Two different CVEs were assigned to this issue.

CVE-2015-5522

Malformed html documents could lead to a heap-buffer-overflow.

CVE-2015-5523

Malformed html documents could lead to allocate 4Gb of memory.

For the Squeeze distribution, this issue has been fixed in the 20091223cvs-1+deb6u1 version of tidy.

We recommend that you upgrade your tidy packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Geoff McLane reports :

tidy is affected by a write out of bounds when processing malformed html files.

This issue could be abused on server side applications that use php-tidy extension with user input.

The issue was confirmed, analyzed, and fixed by the tidy5 maintainer.

ID	Name	Product	Family	Severity
8982	Mac OS X < 10.11 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
8979	Apple iOS < 9.0 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	critical
86270	Mac OS X < 10.11 Multiple Vulnerabilities (GHOST)	Nessus	MacOS X Local Security Checks	critical
85987	Apple iOS < 9.0 Multiple Vulnerabilities	Nessus	Mobile Devices	critical
85904	SUSE SLED11 Security Update : tidy (SUSE-SU-2015:1525-1)	Nessus	SuSE Local Security Checks	medium
85123	Ubuntu 14.04 LTS : HTML Tidy vulnerabilities (USN-2695-1)	Nessus	Ubuntu Local Security Checks	high
84837	Debian DSA-3309-1 : tidy - security update	Nessus	Debian Local Security Checks	medium
84831	Debian DLA-273-1 : tidy security update	Nessus	Debian Local Security Checks	medium
84044	FreeBSD : tidy -- heap-buffer-overflow (bd1ab7a5-0e01-11e5-9976-a0f3c100ae18)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2015-5523

high

Tenable Plugins

critical

critical

critical

critical

medium

high

medium

medium

medium