HTML-Parser Invalid HTML Entity Remote Denial of Service Vulnerability

Bugtraq ID:	36807
Class:	Design Error
CVE:	CVE-2009-3627
Remote:	Yes
Local:	No
Published:	Oct 23 2009 12:00AM
Updated:	Jan 12 2010 05:11PM
Credit:	Mark Martinec
Vulnerable:	Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 SuSE Linux Enterprise Server 11 + Linux kernel 2.6.5 SuSE Linux Enterprise Server 10.SP2 SP SuSE Linux Enterprise Server 10 SP3 + Linux kernel 2.6.5 S.u.S.E. openSUSE 11.2 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 Pardus Linux 2009 0 Pardus Linux 2008 0 HTML-Parser HTML-Parser 3.54 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:	HTML-Parser HTML-Parser 3.63

HTML-Parser Invalid HTML Entity Remote Denial of Service Vulnerability

HTML-Parser is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to cause an affected application that uses the module to fall into an infinite loop, denying service to legitimate users.

Versions prior to HTML-Parser 3.63 are vulnerable.

HTML-Parser Invalid HTML Entity Remote Denial of Service Vulnerability

Attackers can exploit this issue by tricking an unsuspecting victim into processing a malicious page with an affected application.

HTML-Parser Invalid HTML Entity Remote Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.


Ubuntu Ubuntu Linux 9.10 sparc

• Ubuntu libhtml-parser-perl_3.61-1ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libh/libhtml-parser-perl/libhtml-par ser-perl_3.61-1ubuntu0.1_sparc.deb

Debian Linux 4.0 arm

• Debian libhtml-parser-perl_3.55-1+etch1_arm.deb
  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/ libhtml-parser-perl_3.55-1+etch1_arm.deb

Debian Linux 5.0 ia-64

• Debian libhtml-parser-perl_3.56-1+lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/ libhtml-parser-perl_3.56-1+lenny1_ia64.deb

Ubuntu Ubuntu Linux 8.04 LTS powerpc

• Ubuntu libhtml-parser-perl_3.56-1ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libh/libhtml-parser-perl/libhtml-par ser-perl_3.56-1ubuntu0.1_powerpc.deb

Ubuntu Ubuntu Linux 8.10 powerpc

• Ubuntu libhtml-parser-perl_3.56-1ubuntu2.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libh/libhtml-parser-perl/libhtml-par ser-perl_3.56-1ubuntu2.1_powerpc.deb

Debian Linux 4.0 powerpc

• Debian libhtml-parser-perl_3.55-1+etch1_powerpc.deb
  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/ libhtml-parser-perl_3.55-1+etch1_powerpc.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

• Ubuntu libhtml-parser-perl_3.56-1ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libh/libhtml-parser-perl/libhtml-par ser-perl_3.56-1ubuntu0.1_sparc.deb

Ubuntu Ubuntu Linux 8.10 i386

• Ubuntu libhtml-parser-perl_3.56-1ubuntu2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhtml-parser-perl/l ibhtml-parser-perl_3.56-1ubuntu2.1_i386.deb

Ubuntu Ubuntu Linux 9.10 powerpc

• Ubuntu libhtml-parser-perl_3.61-1ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libh/libhtml-parser-perl/libhtml-par ser-perl_3.61-1ubuntu0.1_powerpc.deb

Ubuntu Ubuntu Linux 6.06 LTS sparc

• Ubuntu libhtml-parser-perl_3.48-1ubuntu0.1_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhtml-parser-perl/l ibhtml-parser-perl_3.48-1ubuntu0.1_sparc.deb

Debian Linux 5.0 alpha

• Debian libhtml-parser-perl_3.56-1+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/ libhtml-parser-perl_3.56-1+lenny1_alpha.deb

Debian Linux 5.0 ia-32

• Debian libhtml-parser-perl_3.56-1+lenny1_i386.deb
  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/ libhtml-parser-perl_3.56-1+lenny1_i386.deb

Ubuntu Ubuntu Linux 6.06 LTS powerpc

• Ubuntu libhtml-parser-perl_3.48-1ubuntu0.1_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhtml-parser-perl/l ibhtml-parser-perl_3.48-1ubuntu0.1_powerpc.deb

Ubuntu Ubuntu Linux 8.04 LTS amd64

• Ubuntu libhtml-parser-perl_3.56-1ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhtml-parser-perl/l ibhtml-parser-perl_3.56-1ubuntu0.1_amd64.deb

Debian Linux 5.0 s/390

• Debian libhtml-parser-perl_3.56-1+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/ libhtml-parser-perl_3.56-1+lenny1_s390.deb

HTML-Parser HTML-Parser 3.54

• HTML-Parser HTML-Parser-3.63.tar.gz
  http://search.cpan.org/CPAN/authors/id/G/GA/GAAS/HTML-Parser-3.63.tar. gz

Ubuntu Ubuntu Linux 9.10 lpia

• Ubuntu libhtml-parser-perl_3.61-1ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libh/libhtml-parser-perl/libhtml-par ser-perl_3.61-1ubuntu0.1_lpia.deb

Debian Linux 5.0 mipsel

• Debian libhtml-parser-perl_3.56-1+lenny1_mipsel.deb
  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/ libhtml-parser-perl_3.56-1+lenny1_mipsel.deb

Ubuntu Ubuntu Linux 9.04 sparc

• Ubuntu libhtml-parser-perl_3.59-1ubuntu1.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libh/libhtml-parser-perl/libhtml-par ser-perl_3.59-1ubuntu1.1_sparc.deb

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu libhtml-parser-perl_3.56-1ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libh/libhtml-parser-perl/libhtml-par ser-perl_3.56-1ubuntu0.1_lpia.deb

Ubuntu Ubuntu Linux 9.04 powerpc

• Ubuntu libhtml-parser-perl_3.59-1ubuntu1.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libh/libhtml-parser-perl/libhtml-par ser-perl_3.59-1ubuntu1.1_powerpc.deb

Ubuntu Ubuntu Linux 6.06 LTS i386

• Ubuntu libhtml-parser-perl_3.48-1ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhtml-parser-perl/l ibhtml-parser-perl_3.48-1ubuntu0.1_i386.deb

Ubuntu Ubuntu Linux 8.10 lpia

• Ubuntu libhtml-parser-perl_3.56-1ubuntu2.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libh/libhtml-parser-perl/libhtml-par ser-perl_3.56-1ubuntu2.1_lpia.deb

Debian Linux 4.0 amd64

• Debian libhtml-parser-perl_3.55-1+etch1_amd64.deb
  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/ libhtml-parser-perl_3.55-1+etch1_amd64.deb

Ubuntu Ubuntu Linux 6.06 LTS amd64

• Ubuntu libhtml-parser-perl_3.48-1ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhtml-parser-perl/l ibhtml-parser-perl_3.48-1ubuntu0.1_amd64.deb

Debian Linux 4.0 ia-32

• Debian libhtml-parser-perl_3.55-1+etch1_i386.deb
  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/ libhtml-parser-perl_3.55-1+etch1_i386.deb

Debian Linux 5.0 hppa

• Debian libhtml-parser-perl_3.56-1+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/ libhtml-parser-perl_3.56-1+lenny1_hppa.deb

Debian Linux 4.0 hppa

• Debian libhtml-parser-perl_3.55-1+etch1_hppa.deb
  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/ libhtml-parser-perl_3.55-1+etch1_hppa.deb

Ubuntu Ubuntu Linux 9.04 i386

• Ubuntu libhtml-parser-perl_3.59-1ubuntu1.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhtml-parser-perl/l ibhtml-parser-perl_3.59-1ubuntu1.1_i386.deb

Debian Linux 4.0 sparc

• Debian libhtml-parser-perl_3.55-1+etch1_sparc.deb
  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/ libhtml-parser-perl_3.55-1+etch1_sparc.deb

Debian Linux 4.0 s/390

• Debian libhtml-parser-perl_3.55-1+etch1_s390.deb
  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/ libhtml-parser-perl_3.55-1+etch1_s390.deb

Ubuntu Ubuntu Linux 9.04 lpia

• Ubuntu libhtml-parser-perl_3.59-1ubuntu1.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libh/libhtml-parser-perl/libhtml-par ser-perl_3.59-1ubuntu1.1_lpia.deb

Ubuntu Ubuntu Linux 8.10 sparc

• Ubuntu libhtml-parser-perl_3.56-1ubuntu2.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libh/libhtml-parser-perl/libhtml-par ser-perl_3.56-1ubuntu2.1_sparc.deb

Debian Linux 5.0 arm

• Debian libhtml-parser-perl_3.56-1+lenny1_arm.deb
  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/ libhtml-parser-perl_3.56-1+lenny1_arm.deb

Ubuntu Ubuntu Linux 9.10 i386

• Ubuntu libhtml-parser-perl_3.61-1ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhtml-parser-perl/l ibhtml-parser-perl_3.61-1ubuntu0.1_i386.deb

Debian Linux 4.0 alpha

• Debian libhtml-parser-perl_3.55-1+etch1_alpha.deb
  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/ libhtml-parser-perl_3.55-1+etch1_alpha.deb

Debian Linux 5.0 armel

• Debian libhtml-parser-perl_3.56-1+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/ libhtml-parser-perl_3.56-1+lenny1_armel.deb

Ubuntu Ubuntu Linux 9.10 amd64

• Ubuntu libhtml-parser-perl_3.61-1ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhtml-parser-perl/l ibhtml-parser-perl_3.61-1ubuntu0.1_amd64.deb

Ubuntu Ubuntu Linux 8.04 LTS i386

• Ubuntu libhtml-parser-perl_3.56-1ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhtml-parser-perl/l ibhtml-parser-perl_3.56-1ubuntu0.1_i386.deb

Debian Linux 4.0 mipsel

• Debian libhtml-parser-perl_3.55-1+etch1_mipsel.deb
  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/ libhtml-parser-perl_3.55-1+etch1_mipsel.deb

Debian Linux 5.0 amd64

• Debian libhtml-parser-perl_3.56-1+lenny1_amd64.deb
  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/ libhtml-parser-perl_3.56-1+lenny1_amd64.deb

Debian Linux 5.0 mips

• Debian libhtml-parser-perl_3.56-1+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/ libhtml-parser-perl_3.56-1+lenny1_mips.deb

Ubuntu Ubuntu Linux 9.04 amd64

• Ubuntu libhtml-parser-perl_3.59-1ubuntu1.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhtml-parser-perl/l ibhtml-parser-perl_3.59-1ubuntu1.1_amd64.deb

Debian Linux 5.0 powerpc

• Debian libhtml-parser-perl_3.56-1+lenny1_powerpc.deb
  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/ libhtml-parser-perl_3.56-1+lenny1_powerpc.deb

Ubuntu Ubuntu Linux 8.10 amd64

• Ubuntu libhtml-parser-perl_3.56-1ubuntu2.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhtml-parser-perl/l ibhtml-parser-perl_3.56-1ubuntu2.1_amd64.deb

Debian Linux 4.0 ia-64

• Debian libhtml-parser-perl_3.55-1+etch1_ia64.deb
  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/ libhtml-parser-perl_3.55-1+etch1_ia64.deb

Debian Linux 4.0 mips

• Debian libhtml-parser-perl_3.55-1+etch1_mips.deb
  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/ libhtml-parser-perl_3.55-1+etch1_mips.deb

Debian Linux 5.0 sparc

• Debian libhtml-parser-perl_3.56-1+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/ libhtml-parser-perl_3.56-1+lenny1_sparc.deb

HTML-Parser Invalid HTML Entity Remote Denial of Service Vulnerability

References:

• CVE-2009-3627 assignment notification - HTML-Parser-3.63 (Jan iankko Lieskovsky / Red Hat Security Response Team)
  
• Invalid numerical HTML entity crashes perl (Mark Martinec)