Security
Headlines
HeadlinesLatestCVEs

Headline

Gentoo Linux Security Advisory 202405-07

Gentoo Linux Security Advisory 202405-7 - Multiple vulnerabilities have been discovered in HTMLDOC, the worst of which can lead to arbitrary code execution. Versions greater than or equal to 1.9.16 are affected.

Packet Storm
#vulnerability#web#mac#linux#pdf

Gentoo Linux Security Advisory GLSA 202405-07


                                       https://security.gentoo.org/  

Severity: Normal
Title: HTMLDOC: Multiple Vulnerabilities
Date: May 04, 2024
Bugs: #780489
ID: 202405-07


Synopsis

Multiple vulnerabilities have been discovered in HTMLDOC, the worst of
which can lead to arbitrary code execution.

Background

HTMLDOC is a HTML indexer and HTML to PS and PDF converter.

Affected packages

Package Vulnerable Unaffected


app-text/htmldoc < 1.9.16 >= 1.9.16

Description

Multiple vulnerabilities have been discovered in HTMLDOC. Please review
the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All HTMLDOC users should upgrade to the latest version:

emerge --sync

emerge --ask --oneshot --verbose “>=app-text/htmldoc-1.9.16”

References

[ 1 ] CVE-2021-20308
https://nvd.nist.gov/vuln/detail/CVE-2021-20308
[ 2 ] CVE-2021-23158
https://nvd.nist.gov/vuln/detail/CVE-2021-23158
[ 3 ] CVE-2021-23165
https://nvd.nist.gov/vuln/detail/CVE-2021-23165
[ 4 ] CVE-2021-23180
https://nvd.nist.gov/vuln/detail/CVE-2021-23180
[ 5 ] CVE-2021-23191
https://nvd.nist.gov/vuln/detail/CVE-2021-23191
[ 6 ] CVE-2021-23206
https://nvd.nist.gov/vuln/detail/CVE-2021-23206
[ 7 ] CVE-2021-26252
https://nvd.nist.gov/vuln/detail/CVE-2021-26252
[ 8 ] CVE-2021-26259
https://nvd.nist.gov/vuln/detail/CVE-2021-26259
[ 9 ] CVE-2021-26948
https://nvd.nist.gov/vuln/detail/CVE-2021-26948
[ 10 ] CVE-2021-33235
https://nvd.nist.gov/vuln/detail/CVE-2021-33235
[ 11 ] CVE-2021-33236
https://nvd.nist.gov/vuln/detail/CVE-2021-33236
[ 12 ] CVE-2021-40985
https://nvd.nist.gov/vuln/detail/CVE-2021-40985
[ 13 ] CVE-2021-43579
https://nvd.nist.gov/vuln/detail/CVE-2021-43579
[ 14 ] CVE-2022-0137
https://nvd.nist.gov/vuln/detail/CVE-2022-0137
[ 15 ] CVE-2022-0534
https://nvd.nist.gov/vuln/detail/CVE-2022-0534
[ 16 ] CVE-2022-24191
https://nvd.nist.gov/vuln/detail/CVE-2022-24191
[ 17 ] CVE-2022-27114
https://nvd.nist.gov/vuln/detail/CVE-2022-27114
[ 18 ] CVE-2022-28085
https://nvd.nist.gov/vuln/detail/CVE-2022-28085
[ 19 ] CVE-2022-34033
https://nvd.nist.gov/vuln/detail/CVE-2022-34033
[ 20 ] CVE-2022-34035
https://nvd.nist.gov/vuln/detail/CVE-2022-34035

Availability

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

https://security.gentoo.org/glsa/202405-07

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users’ machines is of utmost
importance to us. Any security concerns should be addressed to
[email protected] or alternatively, you may file a bug at
https://bugs.gentoo.org.

License

Copyright 2024 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Related news

CVE-2022-0137: Fix potential heap overflow bug with GIF images (Issue #461) · michaelrsweet/htmldoc@71fe878

A heap buffer overflow in image_set_mask function of HTMLDOC before 1.9.15 allows an attacker to write outside the buffer boundaries.

CVE-2022-34035: AddressSanitizer: heap-buffer-overflow on write_node htmldoc/htmldoc/html.cxx:588 · Issue #426 · michaelrsweet/htmldoc

HTMLDoc v1.9.12 and below was discovered to contain a heap overflow via e_node htmldoc/htmldoc/html.cxx:588.

CVE-2022-34033: AddressSanitizer: heap-buffer-overflow on (write_header) /htmldoc/htmldoc/html.cxx:273 · Issue #425 · michaelrsweet/htmldoc

HTMLDoc v1.9.15 was discovered to contain a heap overflow via (write_header) /htmldoc/htmldoc/html.cxx:273.

Ubuntu Security Notice USN-5438-1

Ubuntu Security Notice 5438-1 - It was discovered that HTMLDOC did not properly manage memory under certain circumstances. If a user were tricked into opening a specially crafted HTML file, a remote attacker could possibly use this issue to cause HTMLDOC to crash, resulting in a denial of service, or possibly execute arbitrary code.

CVE-2022-27114: Fix a potential integer overflow bug in the JPEG and PNG loaders (Iss… · michaelrsweet/htmldoc@31f7804

There is a vulnerability in htmldoc 1.9.16. In image_load_jpeg function image.cxx when it calls malloc,'img->width' and 'img->height' they are large enough to cause an integer overflow. So, the malloc function may return a heap blosmaller than the expected size, and it will cause a buffer overflow/Address boundary error in the jpeg_read_scanlines function.

CVE-2022-27114: Fix a potential integer overflow bug in the JPEG and PNG loaders (Iss… · michaelrsweet/htmldoc@31f7804

There is a vulnerability in htmldoc 1.9.16. In image_load_jpeg function image.cxx when it calls malloc,'img->width' and 'img->height' they are large enough to cause an integer overflow. So, the malloc function may return a heap blosmaller than the expected size, and it will cause a buffer overflow/Address boundary error in the jpeg_read_scanlines function.

CVE-2021-26948: SEGV on unknown address 0x000000000000 · Issue #410 · michaelrsweet/htmldoc

Null pointer dereference in the htmldoc v1.9.11 and before may allow attackers to execute arbitrary code and cause a denial of service via a crafted html file.

Packet Storm: Latest News

Red Hat Security Advisory 2024-8690-03