CVE-2021-34119
A flaw was discovered in htmodoc 1.9.12 in function parse_paragraph in ps-pdf.cxx ,this flaw...
A flaw was discovered in htmodoc 1.9.12 in function parse_paragraph in ps-pdf.cxx ,this flaw possibly allows possible code execution and a denial of service via a crafted file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
7.8
A flaw was discovered in htmodoc 1.9.12 in function parse_paragraph in ps-pdf.cxx ,this flaw possibly allows possible code execution and a denial of service via a crafted file.
- Record
CVE-2021-34119- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
A flaw was discovered in htmodoc 1.9.12 in function parse_paragraph in ps-pdf.cxx ,this flaw possibly allows possible code execution and a denial of service via a crafted file.
- Record
CVE-2021-34119- Updated
- 2026-11-02
EUVDEUVD-2021-20782 No score
A flaw was discovered in htmodoc 1.9.12 in function parse_paragraph in ps-pdf.cxx ,this flaw possibly allows possible code execution and a denial of service via a crafted file.
- Record
EUVD-2021-20782- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qq6p-768q-h7g2
7.8
A flaw was discovered in htmodoc 1.9.12 in function parse_paragraph in ps-pdf.cxx ,this flaw...
A flaw was discovered in htmodoc 1.9.12 in function parse_paragraph in ps-pdf.cxx ,this flaw possibly allows possible code execution and a denial of service via a crafted file.
- Record
GHSA-qq6p-768q-h7g2- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
7.8
A flaw was discovered in htmodoc 1.9.12 in function parse_paragraph in ps-pdf.cxx ,this flaw possibly allows possible code execution and a denial of service via a crafted file.
- Record
CVE-2021-34119- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-34119
7.8
A flaw was discovered in htmodoc 1.9.12 in function parse_paragraph in ps-pdf.cxx ,this flaw possibly allows possible code execution and a denial of service via a crafted file.
- Record
DEBIAN-CVE-2021-34119- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-34119
7.8
A flaw was discovered in htmodoc 1.9.12 in function parse_paragraph in ps-pdf.cxx ,this flaw possibly allows possible code execution and a denial of service via a crafted file.
- Record
UBUNTU-CVE-2021-34119- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-7189-1 No score
HTMLDOC vulnerabilities
It was discovered that HTMLDOC incorrectly handled certain inputs, which could lead to an integer overflow. An attacker could potentially use this issue to cause a denial of service or execute arbitrary code. (CVE-2021-20308)
It was discovered that HTMLDOC incorrectly handled memory in pspdf_export, which could lead to a double-free. An attacker could potentially use this issue to cause a denial of service or execute arbitrary code. (CVE-2021-23158)
It was discovered that HTMLDOC incorrectly handled memory when loading a JPEG image, which could lead to a NULL pointer dereference. An attacker could potentially use this issue to cause a denial of service. (CVE-2021-23191, CVE-2021-26948)
It was discovered that HTMLDOC incorrectly handled certain inputs, which could lead to a stack buffer overflow. An attacker could potentially use this issue to cause a denial of service or execute arbitrary code. (CVE-2021-23206, CVE-2021-40985, CVE-2021-43579)
It was discovered that HTMLDOC incorrectly handled memory in pdpdf_prepare_page and render_table_row, which could lead to a heap buffer overflow. An attacker could potentially use this issue to cause a denial of service or execute arbitrary code. (CVE-2021-26252, CVE-2021-26259)
It was discovered that HTMLDOC incorrectly handled memory in parse_paragraph, which could lead to a heap buffer overflow. An attacker could potentially use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-34119)
It was discovered that HTMLDOC incorrectly handled memory in parse_tree. An attacker could potentially use this issue to leak sensitive information. (CVE-2021-34121)
- Record
USN-7189-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
htmldocDebian:12 |
before 1.9.12-1 | 1.9.12-1 |
htmldocDebian:13 |
before 1.9.12-1 | 1.9.12-1 |
htmldocDebian:14 |
before 1.9.12-1 | 1.9.12-1 |
htmldocUbuntu:Pro:14.04:LTS |
before 1.8.27-8ubuntu1+esm3, plus listed versions 1.8.27-8ubuntu11.8.27-8ubuntu1+esm11.8.27-8ubuntu1+esm2 |
1.8.27-8ubuntu1+esm3 |
htmldocUbuntu:Pro:16.04:LTS |
before 1.8.27-8ubuntu1.1+esm2, plus listed versions 1.8.27-8ubuntu11.8.27-8ubuntu1.11.8.27-8ubuntu1.1+esm1 |
1.8.27-8ubuntu1.1+esm2 |
htmldocUbuntu:Pro:18.04:LTS |
before 1.9.2-1ubuntu0.2+esm1, plus listed versions 1.8.27-8ubuntu21.8.27-8ubuntu31.9.2-11.9.2-1ubuntu0.11.9.2-1ubuntu0.2 |
1.9.2-1ubuntu0.2+esm1 |
htmldocUbuntu:Pro:20.04:LTS |
before 1.9.7-1ubuntu0.3+esm1, plus listed versions 1.9.3-11.9.7-11.9.7-1build11.9.7-1ubuntu0.21.9.7-1ubuntu0.3 |
1.9.7-1ubuntu0.3+esm1 |
htmldocUbuntu:Pro:14.04:LTS From an advisory covering 11 CVEs |
before 1.8.27-8ubuntu1+esm3, plus listed versions 1.8.27-8ubuntu11.8.27-8ubuntu1+esm11.8.27-8ubuntu1+esm2 |
1.8.27-8ubuntu1+esm3 |
htmldocUbuntu:Pro:16.04:LTS From an advisory covering 11 CVEs |
before 1.8.27-8ubuntu1.1+esm2, plus listed versions 1.8.27-8ubuntu11.8.27-8ubuntu1.11.8.27-8ubuntu1.1+esm1 |
1.8.27-8ubuntu1.1+esm2 |
htmldocUbuntu:Pro:18.04:LTS From an advisory covering 11 CVEs |
before 1.9.2-1ubuntu0.2+esm1, plus listed versions 1.8.27-8ubuntu21.8.27-8ubuntu31.9.2-11.9.2-1ubuntu0.11.9.2-1ubuntu0.2 |
1.9.2-1ubuntu0.2+esm1 |
htmldocUbuntu:Pro:20.04:LTS From an advisory covering 11 CVEs |
before 1.9.7-1ubuntu0.3+esm1, plus listed versions 1.9.3-11.9.7-11.9.7-1build11.9.7-1ubuntu0.21.9.7-1ubuntu0.3 |
1.9.7-1ubuntu0.3+esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-34119 is a high vulnerability (CVSS 7.8) in Htmldoc Project Htmldoc, published July 18, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in htmldoc 1.9.12-1.
References
github.com/michaelrsweet/htmldoc/issues/431
github.com/michaelrsweet/htmldoc/commit/85fa76d77ed69927d24decf476e69bedc7691f48
nvd.nist.gov/vuln/detail/CVE-2021-34119
github.com/advisories/GHSA-qq6p-768q-h7g2
security-tracker.debian.org/tracker/CVE-2021-34119
ubuntu.com/security/CVE-2021-34119
Show 12 moreShow less
cve.org/CVERecord?id=CVE-2021-34119
ubuntu.com/security/notices/USN-7189-1
ubuntu.com/security/CVE-2021-20308
ubuntu.com/security/CVE-2021-23158
ubuntu.com/security/CVE-2021-23191
ubuntu.com/security/CVE-2021-23206
ubuntu.com/security/CVE-2021-26252
ubuntu.com/security/CVE-2021-26259
ubuntu.com/security/CVE-2021-26948
ubuntu.com/security/CVE-2021-34121
ubuntu.com/security/CVE-2021-40985
ubuntu.com/security/CVE-2021-43579