Bug 897952 (CVE-2021-33391)

Summary:	app-text/htmltidy: arbitrary code execution
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	CONFIRMED ---
Severity:	normal	CC:	marecki, monsieurp
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/htacg/tidy-html5/issues/946
Whiteboard:	B2 [upstream/ebuild]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2023-02-26 18:10:51 UTC

CVE-2021-33391:

An issue in HTACG HTML Tidy v5.7.28 allows attacker to execute arbitrary code via the -g option of the CleanNode() function in gdoc.c.

Fix looks to be in 5.9.14-next, 5.9.9-next, 5.9.8-next.