Summary
It was discovered that HTMLDOC incorrectly handled certain inputs, which
could lead to an integer overflow. An attacker could potentially use this
issue to cause a denial of service or execute arbitrary code.
(CVE-2021-20308)
It was discovered that HTMLDOC incorrectly handled memory in pspdf_export,
which could lead to a double-free. An attacker could potentially use this
issue to cause a denial of service or execute arbitrary code.
(CVE-2021-23158)
It was discovered that HTMLDOC incorrectly handled memory when loading a
JPEG image, which could lead to a NULL pointer dereference. An attacker
could potentially use this issue to cause a denial of service.
(CVE-2021-23191, CVE-2021-26948)
It was discovered that HTMLDOC incorrectly handled certain inputs, which
could lead to a stack buffer overflow. An attacker could potentially use
this issue to cause a denial of service or execute arbitrary code.
(CVE-2021-23206, CVE-2021-40985, CVE-2021-43579)
It was discovered that HTMLDOC incorrectly handled memory in
pdpdf_prepare_page and render_table_row, which could lead to a heap buffer
overflow. An attacker could potentially use this issue to cause a denial
of service or execute arbitrary code. (CVE-2021-26252, CVE-2021-26259)
It was discovered that HTMLDOC incorrectly handled memory in
parse_paragraph, which could lead to a heap buffer overflow. An attacker
could potentially use this issue to cause a denial of service or execute
arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-34119)
It was discovered that HTMLDOC incorrectly handled memory in parse_tree.
An attacker could potentially use this issue to leak sensitive
information. (CVE-2021-34121)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | htmldoc | 1.8.27-8ubuntu1+esm3 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | htmldoc | 1.8.27-8ubuntu1.1+esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | htmldoc | 1.9.2-1ubuntu0.2+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | htmldoc | 1.9.7-1ubuntu0.3+esm1 |
Vulnerabilities 11
-
Unscored —
Integer overflow in the htmldoc 1.9.11 and before may allow attackers to execute arbitrary code and cause a denial of s…
-
Unscored —
A flaw was found in htmldoc in v1.9.12. Double-free in function pspdf_export(),in ps-pdf.cxx may result in a write-what…
-
Unscored —
A security issue was found in htmldoc v1.9.12 and before. A NULL pointer dereference in the function image_load_jpeg() …
-
Unscored —
A flaw was found in htmldoc in v1.9.12 and prior. A stack buffer overflow in parse_table() in ps-pdf.cxx may lead to ex…
-
Unscored —
A flaw was found in htmldoc in v1.9.12. Heap buffer overflow in pspdf_prepare_page(),in ps-pdf.cxx may lead to execute …
-
Unscored —
A flaw was found in htmldoc in v1.9.12. Heap buffer overflow in render_table_row(),in ps-pdf.cxx may lead to arbitrary …
-
Unscored —
Null pointer dereference in the htmldoc v1.9.11 and before may allow attackers to execute arbitrary code and cause a de…
-
Unscored —
A flaw was discovered in htmodoc 1.9.12 in function parse_paragraph in ps-pdf.cxx ,this flaw possibly allows possible c…
-
Unscored —
An Out of Bounds flaw was discovered in htmodoc 1.9.12 in function parse_tree() in toc.cxx, this possibly leads to memo…
-
Unscored —
A stack-based buffer under-read in htmldoc before 1.9.12, allows attackers to cause a denial of service via a crafted B…
-
Unscored —CVE-2021-43579 Public exploit
A stack-based buffer overflow in image_load_bmp() in HTMLDOC <= 1.9.13 results in remote code execution if the victim c…
References
-
report
https://ubuntu.com/security/CVE-2021-20308
-
report
https://ubuntu.com/security/CVE-2021-23158
-
report
https://ubuntu.com/security/CVE-2021-23191
-
report
https://ubuntu.com/security/CVE-2021-23206
-
report
https://ubuntu.com/security/CVE-2021-26252
-
report
https://ubuntu.com/security/CVE-2021-26259
-
report
https://ubuntu.com/security/CVE-2021-26948
-
report
https://ubuntu.com/security/CVE-2021-34119
-
report
https://ubuntu.com/security/CVE-2021-34121
-
report
https://ubuntu.com/security/CVE-2021-40985
-
report
https://ubuntu.com/security/CVE-2021-43579