{"id":"CVE-2022-0534","aliases":["DEBIAN-CVE-2022-0534","DLA-2928-1","EUVD-2022-15659","GHSA-f9qm-5g8q-g45w","MGASA-2022-0082","SUSE-SU-2022:14898-1","UBUNTU-CVE-2022-0534","USN-7225-1"],"status":"published","title":"A vulnerability was found in htmldoc version 1.9.15 where the stack out-of-bounds read takes...","description":"A vulnerability was found in htmldoc version 1.9.15 where the stack out-of-bounds read takes place in gif_get_code() and occurs when opening a malicious GIF file, which can result in a crash (segmentation fault).","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0094,"percentile":0.61186,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2022-02-09T22:03:41Z","modified":"2026-11-03T08:00:24Z","fixes":[{"ecosystem":"Debian:12","package":"htmldoc","fixed_in":["1.9.15-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"htmldoc","fixed_in":["1.9.15-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"htmldoc","fixed_in":["1.9.15-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"htmldoc","fixed_in":["1.9.15-1.mga8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"htmldoc","fixed_in":["1.8.27-8ubuntu1+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"htmldoc","fixed_in":["1.8.27-8ubuntu1.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"htmldoc","fixed_in":["1.9.2-1ubuntu0.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"htmldoc","fixed_in":["1.9.7-1ubuntu0.3+esm2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-8+deb9u2"}]}],"versions":["1.8.27-8","1.8.27-8+deb9u1"],"bundled":3},{"source":"osv","ecosystem":"Mageia:8","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-1.mga8"}]}]},{"source":"osv","ecosystem":"SUSE:Subscription Management Tool 11 SP3","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-170.4.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-8ubuntu1+esm4"}]}],"versions":["1.8.27-8ubuntu1","1.8.27-8ubuntu1+esm1","1.8.27-8ubuntu1+esm2","1.8.27-8ubuntu1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-8ubuntu1.1+esm3"}]}],"versions":["1.8.27-8ubuntu1","1.8.27-8ubuntu1.1","1.8.27-8ubuntu1.1+esm1","1.8.27-8ubuntu1.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-1ubuntu0.2+esm2"}]}],"versions":["1.8.27-8ubuntu2","1.8.27-8ubuntu3","1.9.2-1","1.9.2-1ubuntu0.1","1.9.2-1ubuntu0.2","1.9.2-1ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.7-1ubuntu0.3+esm2"}]}],"versions":["1.9.3-1","1.9.7-1","1.9.7-1build1","1.9.7-1ubuntu0.2","1.9.7-1ubuntu0.3","1.9.7-1ubuntu0.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-8ubuntu1+esm4"}]}],"versions":["1.8.27-8ubuntu1","1.8.27-8ubuntu1+esm1","1.8.27-8ubuntu1+esm2","1.8.27-8ubuntu1+esm3"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-8ubuntu1.1+esm3"}]}],"versions":["1.8.27-8ubuntu1","1.8.27-8ubuntu1.1","1.8.27-8ubuntu1.1+esm1","1.8.27-8ubuntu1.1+esm2"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-1ubuntu0.2+esm2"}]}],"versions":["1.8.27-8ubuntu2","1.8.27-8ubuntu3","1.9.2-1","1.9.2-1ubuntu0.1","1.9.2-1ubuntu0.2","1.9.2-1ubuntu0.2+esm1"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.7-1ubuntu0.3+esm2"}]}],"versions":["1.9.3-1","1.9.7-1","1.9.7-1build1","1.9.7-1ubuntu0.2","1.9.7-1ubuntu0.3","1.9.7-1ubuntu0.3+esm1"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-1ubuntu0.1~esm1"}]}],"versions":["1.9.11-4","1.9.12-1","1.9.13-1","1.9.14-1","1.9.15-1"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.17-1ubuntu0.1~esm1"}]}],"versions":["1.9.16-1","1.9.17-1","1.9.17-1build2","1.9.17-1build3"],"bundled":9}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"htmldoc_project","product":"htmldoc"},{"vendor":"michaelrsweet","product":"htmldoc"}],"references":[{"url":"https://github.com/michaelrsweet/htmldoc/issues/463","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/michaelrsweet/htmldoc/commit/312f0f9c12f26fbe015cd0e6cefa40e4b99017d9","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/02/msg00022.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0534","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f9qm-5g8q-g45w"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0534.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-0534","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0082.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30077","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3NVMNRQWPBYKG2XDRDYA4JPEMALW53MA/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-202214898-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1158802","tags":["report"]},{"url":"https://bugzilla.suse.com/1184424","tags":["report"]},{"url":"https://bugzilla.suse.com/1195758","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0534","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-0534","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0534","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7225-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-0137","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-24191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-27114","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-28085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-34033","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-34035","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45508","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46478","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-0534","description":"A vulnerability was found in htmldoc version 1.9.15 where the stack out-of-bounds read takes place in gif_get_code() and occurs when opening a malicious GIF file, which can result in a crash (segmentation fault).","status":"published","published":"2022-02-09T22:03:41Z","modified":"2024-08-02T23:32:46.162Z","cwes":["CWE-125"],"updated_at":"2026-11-02T14:34:41.69911Z"}],"euvd":[{"id":"EUVD-2022-15659","description":"A vulnerability was found in htmldoc version 1.9.15 where the stack out-of-bounds read takes place in gif_get_code() and occurs when opening a malicious GIF file, which can result in a crash (segmentation fault).","status":"published","published":"2022-02-09T22:03:41Z","modified":"2024-08-02T23:32:46Z","updated_at":"2026-11-03T03:26:04.481305Z"}],"ghsa":[{"id":"GHSA-f9qm-5g8q-g45w","title":"A vulnerability was found in htmldoc version 1.9.15 where the stack out-of-bounds read takes...","description":"A vulnerability was found in htmldoc version 1.9.15 where the stack out-of-bounds read takes place in gif_get_code() and occurs when opening a malicious GIF file, which can result in a crash (segmentation fault).","status":"published","published":"2022-02-11T00:00:54Z","modified":"2023-02-03T05:05:58Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:53:49.274652Z"}],"nvd":[{"id":"CVE-2022-0534","description":"A vulnerability was found in htmldoc version 1.9.15 where the stack out-of-bounds read takes place in gif_get_code() and occurs when opening a malicious GIF file, which can result in a crash (segmentation fault).","status":"published","published":"2022-02-09T23:15:16.767Z","modified":"2026-06-17T04:20:47.567Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:07:12.155838Z"}],"osv":[{"id":"DEBIAN-CVE-2022-0534","description":"A vulnerability was found in htmldoc version 1.9.15 where the stack out-of-bounds read takes place in gif_get_code() and occurs when opening a malicious GIF file, which can result in a crash (segmentation fault).","status":"published","published":"2022-02-09T23:15:16.767Z","modified":"2026-11-03T08:00:24.259475582Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T08:25:15.646766Z"},{"id":"UBUNTU-CVE-2022-0534","description":"A vulnerability was found in htmldoc version 1.9.15 where the stack out-of-bounds read takes place in gif_get_code() and occurs when opening a malicious GIF file, which can result in a crash (segmentation fault).","status":"published","published":"2022-02-09T23:15:00Z","modified":"2026-02-04T04:33:31.58041Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:53:51.630172Z"},{"id":"CVE-2022-0534","description":"A vulnerability was found in htmldoc version 1.9.15 where the stack out-of-bounds read takes place in gif_get_code() and occurs when opening a malicious GIF file, which can result in a crash (segmentation fault).","status":"published","published":"2022-02-09T22:03:41Z","modified":"2026-10-28T10:23:23.328447319Z","cwes":["CWE-125"],"updated_at":"2026-11-02T15:44:22.824781Z"},{"id":"DLA-2928-1","title":"htmldoc - security update","status":"published","published":"2022-02-26T00:00:00Z","modified":"2026-03-09T01:23:38.786801Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2022-0082","title":"Updated htmldoc packages fix security vulnerability","description":"A vulnerability was found in htmldoc version 1.9.15 where the stack\nout-of-bounds read takes place in gif_get_code() and occurs when opening a\nmalicious GIF file, which can result in a crash (segmentation fault).\n(CVE-2022-0534)\n","status":"published","published":"2022-02-22T21:25:09Z","modified":"2026-04-16T04:41:49.505503319Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"SUSE-SU-2022:14898-1","title":"Security update for htmldoc","description":"This update for htmldoc fixes the following issues:\n\n- CVE-2019-19630: Fixed stack-based buffer overflow in the hd_strlcpy() function in string.c  via a crafted HTML document (bsc#1158802).\n- CVE-2021-20308: Fixed integer overflow in image_load_gif() (bsc#1184424).\n- CVE-2022-0534: Fixed stack out-of-bounds read in gif_get_code() when opening a malicious GIF file results in a segmentation fault (bsc#1195758).\n","status":"published","published":"2022-02-28T13:33:19Z","modified":"2026-02-04T04:31:39.952462Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-7225-1","title":"HTMLDOC vulnerabilities","description":"It was discovered that HTMLDOC incorrectly handled memory in the\nimage_set_mask, git_read_lzw, write_header and write_node functions, which\ncould lead to a heap buffer overflow. An attacker could possibly use this\nissue to cause a denial of service or execute arbitrary code. This issue\nonly affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and\nUbuntu 20.04 LTS. (CVE-2022-0137, CVE-2022-24191, CVE-2022-34033,\nCVE-2022-34035)\n\nIt was discovered that HTMLDOC incorrectly handled memory in the\ngif_get_code function, which could lead to a segmentation fault. If a\nuser or application were tricked into opening a crafted GIF file, an\nattacker could possibly use this issue to cause a denial of service.\nThis issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,\nUbuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-0534)\n\nIt was discovered that HTMLDOC did not perform proper bounds checks on\nimage dimensions when loading JPEG images, which could lead to a buffer\noverflow. If a user or application were tricked into opening a crafted\nJPEG image, an attacker could possibly use this issue to cause a denial\nof service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-27114)\n\nIt was discovered that HTMLDOC incorrectly handled memory in the\npdf_write_names function, which could lead to a heap buffer overflow. If\na user or application were tricked into opening a specially crafted file,\nan attacker could possibly use this issue to cause a denial of service or\nleak sensitive information. This issue only affected Ubuntu 14.04 LTS,\nUbuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.\n(CVE-2022-28085)\n\nIt was discovered that HTMLDOC could be made to write out of bounds when\nattempting to strip whitespace. An attacker could use this issue to cause\na denial of service or execute arbitrary code. (CVE-2024-45508)\n\nIt was discovered that HTMLDOC incorrectly handled memory in the parse_pre\nfunction, which could lead to a heap buffer overflow. If a user or\napplication were tricked into opening a specially crafted file, an attacker\ncould possibly use this issue to cause a denial of service or execute\narbitrary code. (CVE-2024-46478)\n","status":"published","published":"2025-01-22T23:44:08Z","modified":"2026-06-25T13:32:30.759739104Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}