Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2016-10531 →
DEBIAN-CVE-2016-10531
marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML ent...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specifically HTML entities, it's possible to bypass marked's content injection protection (sanitize: true) to inject a javascript: URL. This flaw exists because &#xNNanything; gets parsed to what it could and leaves the rest behind, resulting in just anything; being left.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
node-marked
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6+dfsg-1"}]}]
Debian:13
node-marked
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6+dfsg-1"}]}]
Debian:14
node-marked
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.6+dfsg-1"}]}]
Références
- advisory security-tracker.debian.org