There are 4 open security issues in bookworm.
3 issues left for the package maintainer to handle:
- CVE-2025-6496:
(postponed; to be fixed through a stable update)
A vulnerability was found in HTACG tidy-html5 5.8.0. It has been declared as problematic. This vulnerability affects the function InsertNodeAsParent of the file src/parser.c. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
- CVE-2025-6497:
(postponed; to be fixed through a stable update)
A vulnerability was found in HTACG tidy-html5 5.8.0. It has been rated as problematic. This issue affects the function prvTidyParseNamespace of the file src/parser.c. The manipulation leads to reachable assertion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
- CVE-2025-6498:
(postponed; to be fixed through a stable update)
A vulnerability classified as problematic has been found in HTACG tidy-html5 5.8.0. Affected is the function defaultAlloc of the file src/alloc.c. The manipulation leads to memory leak. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
You can find information about how to handle these issues in the security team's documentation.
1 ignored issue:
- CVE-2021-33391:
An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/t/tidy-html5.png){kind=link}