CVE-2021-23165

A flaw was found in htmldoc before v1.9.12. Heap buffer overflow in pspdf_prepare_outpages(), in ps-pdf.cxx may lead to execute arbitrary code and denial of service.

Updated htmldoc packages fix security vulnerabilities:

Integer overflow in the htmldoc 1.9.11 and before may allow attackers to execute arbitrary code and cause a denial of service that is similar to CVE-2017-9181 (CVE-2021-20308).

AddressSanitizer: double-free in function pspdf_export ps-pdf.cxx (CVE-2021-23158).

AddressSanitizer: heap-buffer-overflow in pspdf_prepare_outpages() in ps-pdf.cxx (CVE-2021-23165).

AddressSanitizer: SEGV in file_extension file.c (CVE-2021-23180).

AddressSanitizer: SEGV on unknown address 0x000000000014 (CVE-2021-23191).

AddressSanitizer: stack-buffer-overflow in parse_table ps-pdf.cxx (CVE-2021-23206).

AddressSanitizer: heap-buffer-overflow in pspdf_prepare_page(int) ps-pdf.cxx (CVE-2021-26252).

AddressSanitizer: heap-buffer-overflow on render_table_row() ps-pdf.cxx (CVE-2021-26259).

SEGV on unknown address 0x000000000000 (CVE-2021-26948).

It was discovered that HTMLDOC did not properly manage memory under certain circumstances. If a user were tricked into opening a specially crafted HTML file, a remote attacker could possibly use this issue to cause HTMLDOC to crash, resulting in a denial of service, or possibly execute arbitrary code.

USN-5438-1 fixed a vulnerability in HTMLDOC. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that HTMLDOC did not properly manage memory under certain circumstances. If a user were tricked into opening a specially crafted HTML file, a remote attacker could possibly use this issue to cause HTMLDOC to crash, resulting in a denial of service, or possibly execute arbitrary code.