{"id":"CVE-2018-17848","published":"2018-10-01T08:00:00Z","modified":"2024-08-05T10:54:10Z","title":"The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a…","vendor":null,"product":null,"tier":"tail","description":{"text":"The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a \"panic: runtime error\" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02234,"percentile":0.82722,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/golang/go/issues/27846","tags":["x_refsource_MISC"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LREEWY6KNLHRWFZ7OT4HVLMVVCGGUHON/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKRCI7WIOCOCD3H7NXWRGIRABTQOZOBK/","tags":["vendor-advisory","x_refsource_FEDORA"]}],"priority":{"score":16.5,"factors":[{"name":"EPSS percentile","points":16.54}]},"affected":[{"ecosystem":"Go","package":"golang.org/x/net","vulnerableRanges":["<0.0.0-20190125002852-4b62a64f59f7"],"patched":["0.0.0-20190125002852-4b62a64f59f7"],"from":["GHSA-mv93-wvcp-7m7r","GO-2022-0197"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-4626","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2018-17143","published":"2018-09-17","fixed":"0.0.0-20180921000356-2f5d2388922f","kev":false},{"cve":"CVE-2018-17142","published":"2018-09-17","fixed":"0.0.0-20180925071336-cf3bd585ca2a","kev":false,"link":{"from":"CVE-2018-17142","to":"CVE-2018-17848","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:golang.org/x/net","fromFixed":"0.0.0-20180925071336-cf3bd585ca2a","toFixed":"0.0.0-20190125002852-4b62a64f59f7","daysApart":14},{"kind":"similar","provenance":"machine","score":0.59,"basis":"same package + description similarity"}]}},{"cve":"CVE-2018-17847","published":"2018-10-01","fixed":"0.0.0-20190125002852-4b62a64f59f7","kev":false},{"cve":"CVE-2018-17848","published":"2018-10-01","fixed":"0.0.0-20190125002852-4b62a64f59f7","kev":false},{"cve":"CVE-2018-17846","published":"2018-10-01","fixed":"0.0.0-20190125091013-d26f9f9a57f3","kev":false,"link":{"from":"CVE-2018-17848","to":"CVE-2018-17846","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:golang.org/x/net","fromFixed":"0.0.0-20190125002852-4b62a64f59f7","toFixed":"0.0.0-20190125091013-d26f9f9a57f3","daysApart":0}]}},{"cve":"CVE-2019-9512","published":"2019-08-13","fixed":"0.0.0-20190813141303-74dc4d7220e7","kev":false},{"cve":"CVE-2019-9514","published":"2019-08-13","fixed":"0.0.0-20190813141303-74dc4d7220e7","kev":false}],"package":"Go:golang.org/x/net"}}