CVE-2016-9909

Name
CVE-2016-9909
Description
The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS) attacks by leveraging mishandling of the < (less than) character in attribute values.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Mailing List http://www.openwall.com/lists/oss-security/2016/12/06/5
Mailing List http://www.openwall.com/lists/oss-security/2016/12/08/8
Third Party Advisory http://www.securityfocus.com/bid/95132
Patch https://github.com/html5lib/html5lib-python/commit/9b8d8eb5afbc066b7fac9390f5ec75e5e8a7cab7
Vendor Advisory https://github.com/html5lib/html5lib-python/issues/11
Vendor Advisory https://github.com/html5lib/html5lib-python/issues/12
Release Notes https://html5lib.readthedocs.io/en/latest/changes.html#b9

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:html5lib:html5lib:*:1.0b8:*:*:*:*:*:* html5lib >= None <= 0.99999999

Vulnerable and fixed packages

Source package Branch Version Maintainer Status