CVE-2018-17846
CVE-2018-17846
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification.
CVSS 7.5 · High · EPSS 2.5%
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
golang-golang-x-net-dev Ubuntu:Pro:16.04:LTS
- Versions
- 0.0+git20150226.3d87fd6-3
- 0.0+git20151007.b846920+dfsg-1
- 1:0.0+git20150817.66f0418-1
- 1:0.0+git20160110.4fd4a9f-1
- 1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm1
- 1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-golang-x-net-dev Ubuntu:Pro:18.04:LTS
- Versions
- 1:0.0+git20170629.c81e7f2+dfsg-1ubuntu1
- 1:0.0+git20170629.c81e7f2+dfsg-1ubuntu2
- 1:0.0+git20170629.c81e7f2+dfsg-2
- 1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm1
- 1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm2
- 1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-golang-x-net-dev Ubuntu:Pro:20.04:LTS
- Versions
- 1:0.0+git20190811.74dc4d7+dfsg-1
- 1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm1
- 1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm2
- 1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://github.com/golang/go/issues/27842
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LREEWY6KNLHRWFZ7OT4HVLMVVCGGUHON/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKRCI7WIOCOCD3H7NXWRGIRABTQOZOBK/
- https://nvd.nist.gov/vuln/detail/CVE-2018-17846