Out-of-bounds write in Jtidy - CVE-2023-34623

Vulnerability identifier: #VU78782

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-34623

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error. A remote attacker can pass a specially crafted object that uses cyclic dependencies and perform a denial of service (DoS) attack.

Jtidy
Amazon Linux AMI
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
Development Tools Module
openSUSE Leap
openEuler
DevOps Model Architect (DMA)
jtidy
jtidy-help
jtidy-javadoc
jtidy-scripts
IBM Business Automation Workflow

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

jtidy - update to 1.0-0.30.20100930svn1125
jtidy-help - update to 1.0-0.30.20100930svn1125
jtidy - addressed in versions 8.0-27.3.1, 8.0-150000.4.3.1, 8.0-150200.11.7.1
jtidy-javadoc - update to 8.0-150200.11.7.1
jtidy-scripts - update to 8.0-150200.11.7.1
IBM Business Automation Workflow - addressed in versions 21.0.3 IF026, 23.0.1 IF004, 23.0.2

• https://github.com/trajano/jtidy/issues/4

• Denial of service in Jtidy
• SUSE update for jtidy
• SUSE update for jtidy
• SUSE update for jtidy
• Out-of-bounds write in IBM DevOps Model Architect (DMA)
• Out-of-bounds write in IBM Business Automation Workflow
• Amazon Linux AMI update for jtidy
• openEuler update for jtidy