CVE-2018-17848

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.

The Parse function can panic on some invalid inputs. For example, the Parse function panics on the input "<svg><template><desc><t><svg></template>".

The html package (aka `x/net/html`) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.

El paquete html (también conocido como x/net/html) hasta el 25/09/2018 en Go gestiona de manera incorrecta <b></b><b>, lo que conduce a un "panic: runtime error" (índice fuera de rango) en (*insertionModeStack).pop en node.go, llamado desde inHeadIM, durante una llamada html.Parse.</b>