GO-2023-1753 Improper handling of empty HTML attributes in html/template

Templates containing actions in unquoted HTML attributes e.g. "attr=." executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags...

Golang < 1.19.9 / 1.20.x < 1.20.4 Multiple Vulnerabilities

The version of Golang Go installed on the remote host is affected by multiple vulnerabilities the html/template component: - Angle brackets are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character could result in...

clamav:clamav_scanmap_HTML_fuzzer: Heap-buffer-overflow in cli_js_parse_done

Detailed Report: https://oss-fuzz.com/testcase?key=6652896370884608 Project: clamav Fuzzing Engine: afl Fuzz Target: clamavscanmapHTMLfuzzer Job Type: aflasanclamav Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x629000004218 Crash State: clijsparsedone clihtmlnormalis...