CVE-2021-20308

Integer overflow in the htmldoc 1.9.11 and before may allow attackers to execute arbitrary code and cause a denial of service that is similar to CVE-2017-9181.

Updated htmldoc packages fix security vulnerabilities:

Integer overflow in the htmldoc 1.9.11 and before may allow attackers to execute arbitrary code and cause a denial of service that is similar to CVE-2017-9181 (CVE-2021-20308).

AddressSanitizer: double-free in function pspdf_export ps-pdf.cxx (CVE-2021-23158).

AddressSanitizer: heap-buffer-overflow in pspdf_prepare_outpages() in ps-pdf.cxx (CVE-2021-23165).

AddressSanitizer: SEGV in file_extension file.c (CVE-2021-23180).

AddressSanitizer: SEGV on unknown address 0x000000000014 (CVE-2021-23191).

AddressSanitizer: stack-buffer-overflow in parse_table ps-pdf.cxx (CVE-2021-23206).

AddressSanitizer: heap-buffer-overflow in pspdf_prepare_page(int) ps-pdf.cxx (CVE-2021-26252).

AddressSanitizer: heap-buffer-overflow on render_table_row() ps-pdf.cxx (CVE-2021-26259).

SEGV on unknown address 0x000000000000 (CVE-2021-26948).

This update for htmldoc fixes the following issues:

htmldoc was updated to version 1.9.12:

• Fixed buffer-overflow CVE-2021-20308 ( boo#1184424 )
• Fixed a crash bug with 'data:' URIs and EPUB output
• Fixed several other crash bugs
• Fixed JPEG error handling
• Fixed some minor issues
• Removed the bundled libjpeg, libpng, and zlib.

update to 1.9.11:

• Added high-resolution desktop icons for Linux.
• Updated the internal HTTP library to fix truncation of redirection URLs
• Fixed a regression in the handling of character entities for UTF-8 input
• The --numbered option did not work when the table-of-contents was disabled
• Updated local zlib to v1.2.11.
• Updated local libpng to v1.6.37.
• Fixed packaging issues on macOS and Windows
• Now ignore sRGB profile errors in PNG files
• The GUI would crash when saving
• Page comments are now allowed in pre text

update to 1.9.9:

• Added support for a HTMLDOC.filename META keyword that controls the filename reported in CGI mode; the default remains 'htmldoc.pdf' (Issue #367)
• Fixed a paragraph formatting issue with large inline images (Issue #369)
• Fixed a buffer underflow issue (Issue #370)
• Fixed PDF page numbers (Issue #371)
• Added support for a new L header/footer format ($LETTERHEAD), which inserts a letterhead image at its full size (Issue #372, Issue #373, Issue #375)
• Updated the build documentation (Issue #374)
• Refactored the PRE rendering code to work around compiler optimization bugs
• Added support for links with targets (Issue #351)
• Fixed a table rowspan + valign bug (Issue #360)
• Added support for data URIs (Issue #340)
• HTMLDOC no longer includes a PDF table of contents when converting a single web page (Issue #344)
• Updated the markdown support with external links, additional inline markup, and hard line breaks.
• Links in markdown text no longer render with a leading space as part of the link (Issue #346)
• Fixed a buffer underflow bug discovered by AddressSanitizer.
• Fixed a bug in UTF-8 support (Issue #348)
• PDF output now includes the base language of the input document(s)
• Optimized the loading of font widths (Issue #354)
• Optimized PDF page resources (Issue #356)
• Optimized the base memory used for font widths (Issue #357)
• Added proper ­ support (Issue #361)
• Title files can now be markdown.
• The GUI did not support EPUB output.
• Empty markdown table cells were not rendered in PDF or PostScript output.
• The automatically-generated title page now supports both 'docnumber' and 'version' metadata.
• Added support for dc:subject and dc:language metadata in EPUB output from the HTML keywords and lang values.
• Added support for the subject and language metadata in markdown input.
• Fixed a buffer underflow bug (Issue #338)
• htmldoc --help now reports whether HTTPS URLs are supported (Issue #339)
• Fixed an issue with HTML title pages and EPUB output.
• Inline fixed-width text is no longer reduced in size automatically
• Optimized initialization of font width data (Issue #334)
• Fixed formatting bugs with aligned images (Issue #322, Issue #324)
• Fixed support for three digit '#RGB' color values (Issue #323)
• Fixed character set support for markdown metadata.
• Updated libpng to v1.6.34 (Issue #326)
• The makefiles did not use the CPPFLAGS value (Issue #328)
• Added Markdown table support.
• Fixed parsing of TBODY, TFOOT, and THEAD elements in HTML files.

This update for htmldoc fixes the following issues:

htmldoc was updated to version 1.9.12

• Fixed buffer-overflow CVE-2021-20308 ( boo#1184424 )
• Fixed a crash bug with 'data:' URIs and EPUB output
• Fixed several other crash bugs
• Fixed JPEG error handling
• Fixed some minor issues
• Removed the bundled libjpeg, libpng, and zlib.

update to 1.9.11:

• Added high-resolution desktop icons for Linux.
• Updated the internal HTTP library to fix truncation of redirection URLs
• Fixed a regression in the handling of character entities for UTF-8 input
• The --numbered option did not work when the table-of-contents was disabled
• Updated local zlib to v1.2.11.
• Updated local libpng to v1.6.37.
• Fixed packaging issues on macOS and Windows
• Now ignore sRGB profile errors in PNG files
• The GUI would crash when saving
• Page comments are now allowed in pre text

update to 1.9.9:

• Added support for a HTMLDOC.filename META keyword that controls the filename reported in CGI mode; the default remains 'htmldoc.pdf' (Issue #367)
• Fixed a paragraph formatting issue with large inline images (Issue #369)
• Fixed a buffer underflow issue (Issue #370)
• Fixed PDF page numbers (Issue #371)
• Added support for a new L header/footer format ($LETTERHEAD), which inserts a letterhead image at its full size (Issue #372, Issue #373, Issue #375)
• Updated the build documentation (Issue #374)
• Refactored the PRE rendering code to work around compiler optimization bugs
• Added support for links with targets (Issue #351)
• Fixed a table rowspan + valign bug (Issue #360)
• Added support for data URIs (Issue #340)
• HTMLDOC no longer includes a PDF table of contents when converting a single web page (Issue #344)
• Updated the markdown support with external links, additional inline markup, and hard line breaks.
• Links in markdown text no longer render with a leading space as part of the link (Issue #346)
• Fixed a buffer underflow bug discovered by AddressSanitizer.
• Fixed a bug in UTF-8 support (Issue #348)
• PDF output now includes the base language of the input document(s)
• Optimized the loading of font widths (Issue #354)
• Optimized PDF page resources (Issue #356)
• Optimized the base memory used for font widths (Issue #357)
• Added proper ­ support (Issue #361)
• Title files can now be markdown.
• The GUI did not support EPUB output.
• Empty markdown table cells were not rendered in PDF or PostScript output.
• The automatically-generated title page now supports both 'docnumber' and 'version' metadata.
• Added support for dc:subject and dc:language metadata in EPUB output from the HTML keywords and lang values.
• Added support for the subject and language metadata in markdown input.
• Fixed a buffer underflow bug (Issue #338)
• htmldoc --help now reports whether HTTPS URLs are supported (Issue #339)
• Fixed an issue with HTML title pages and EPUB output.
• Inline fixed-width text is no longer reduced in size automatically
• Optimized initialization of font width data (Issue #334)
• Fixed formatting bugs with aligned images (Issue #322, Issue #324)
• Fixed support for three digit '#RGB' color values (Issue #323)
• Fixed character set support for markdown metadata.
• Updated libpng to v1.6.34 (Issue #326)
• The makefiles did not use the CPPFLAGS value (Issue #328)
• Added Markdown table support.
• Fixed parsing of TBODY, TFOOT, and THEAD elements in HTML files.

This update for htmldoc fixes the following issues:

Update to version 1.9.12

• Fixed buffer-overflow CVE-2021-20308 ( boo#1184424 )
• Fixed a crash bug with 'data:' URIs and EPUB output
• Fixed several other crash bugs
• Fixed JPEG error handling
• Fixed some minor issues
• Removed the bundled libjpeg, libpng, and zlib.

update to 1.9.11:

• Added high-resolution desktop icons for Linux.
• Updated the internal HTTP library to fix truncation of redirection URLs
• Fixed a regression in the handling of character entities for UTF-8 input
• The --numbered option did not work when the table-of-contents was disabled
• Updated local zlib to v1.2.11.
• Updated local libpng to v1.6.37.
• Fixed packaging issues on macOS and Windows
• Now ignore sRGB profile errors in PNG files
• The GUI would crash when saving
• Page comments are now allowed in pre text

update to 1.9.9:

• Added support for a HTMLDOC.filename META keyword that controls the filename reported in CGI mode; the default remains 'htmldoc.pdf' (Issue #367)
• Fixed a paragraph formatting issue with large inline images (Issue #369)
• Fixed a buffer underflow issue (Issue #370)
• Fixed PDF page numbers (Issue #371)
• Added support for a new L header/footer format ($LETTERHEAD), which inserts a letterhead image at its full size (Issue #372, Issue #373, Issue #375)
• Updated the build documentation (Issue #374)
• Refactored the PRE rendering code to work around compiler optimization bugs
• Added support for links with targets (Issue #351)
• Fixed a table rowspan + valign bug (Issue #360)
• Added support for data URIs (Issue #340)
• HTMLDOC no longer includes a PDF table of contents when converting a single web page (Issue #344)
• Updated the markdown support with external links, additional inline markup, and hard line breaks.
• Links in markdown text no longer render with a leading space as part of the link (Issue #346)
• Fixed a buffer underflow bug discovered by AddressSanitizer.
• Fixed a bug in UTF-8 support (Issue #348)
• PDF output now includes the base language of the input document(s)
• Optimized the loading of font widths (Issue #354)
• Optimized PDF page resources (Issue #356)
• Optimized the base memory used for font widths (Issue #357)
• Added proper ­ support (Issue #361)
• Title files can now be markdown.
• The GUI did not support EPUB output.
• Empty markdown table cells were not rendered in PDF or PostScript output.
• The automatically-generated title page now supports both 'docnumber' and 'version' metadata.
• Added support for dc:subject and dc:language metadata in EPUB output from the HTML keywords and lang values.
• Added support for the subject and language metadata in markdown input.
• Fixed a buffer underflow bug (Issue #338)
• htmldoc --help now reports whether HTTPS URLs are supported (Issue #339)
• Fixed an issue with HTML title pages and EPUB output.
• Inline fixed-width text is no longer reduced in size automatically
• Optimized initialization of font width data (Issue #334)
• Fixed formatting bugs with aligned images (Issue #322, Issue #324)
• Fixed support for three digit '#RGB' color values (Issue #323)
• Fixed character set support for markdown metadata.
• Updated libpng to v1.6.34 (Issue #326)
• The makefiles did not use the CPPFLAGS value (Issue #328)
• Added Markdown table support.
• Fixed parsing of TBODY, TFOOT, and THEAD elements in HTML files.

This update for htmldoc fixes the following issues:

• CVE-2021-20308: Fixed crash bug with bad GIFs, ( boo#1184424 )

• Fixed license, package is GPL 2+ not LGPL

These are all security issues fixed in the htmldoc-1.9.12-1.2 package on the GA media of openSUSE Tumbleweed.

This update for htmldoc fixes the following issues:

• CVE-2019-19630: Fixed stack-based buffer overflow in the hd_strlcpy() function in string.c via a crafted HTML document (bsc#1158802).
• CVE-2021-20308: Fixed integer overflow in image_load_gif() (bsc#1184424).
• CVE-2022-0534: Fixed stack out-of-bounds read in gif_get_code() when opening a malicious GIF file results in a segmentation fault (bsc#1195758).

It was discovered that HTMLDOC incorrectly handled certain inputs, which could lead to an integer overflow. An attacker could potentially use this issue to cause a denial of service or execute arbitrary code. (CVE-2021-20308)

It was discovered that HTMLDOC incorrectly handled memory in pspdf_export, which could lead to a double-free. An attacker could potentially use this issue to cause a denial of service or execute arbitrary code. (CVE-2021-23158)

It was discovered that HTMLDOC incorrectly handled memory when loading a JPEG image, which could lead to a NULL pointer dereference. An attacker could potentially use this issue to cause a denial of service. (CVE-2021-23191, CVE-2021-26948)

It was discovered that HTMLDOC incorrectly handled certain inputs, which could lead to a stack buffer overflow. An attacker could potentially use this issue to cause a denial of service or execute arbitrary code. (CVE-2021-23206, CVE-2021-40985, CVE-2021-43579)

It was discovered that HTMLDOC incorrectly handled memory in pdpdf_prepare_page and render_table_row, which could lead to a heap buffer overflow. An attacker could potentially use this issue to cause a denial of service or execute arbitrary code. (CVE-2021-26252, CVE-2021-26259)

It was discovered that HTMLDOC incorrectly handled memory in parse_paragraph, which could lead to a heap buffer overflow. An attacker could potentially use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-34119)

It was discovered that HTMLDOC incorrectly handled memory in parse_tree. An attacker could potentially use this issue to leak sensitive information. (CVE-2021-34121)