{"id":"CVE-2022-28085","aliases":["DEBIAN-CVE-2022-28085","EUVD-2022-32570","GHSA-xhgj-p5p6-x24h","UBUNTU-CVE-2022-28085","USN-7225-1","openSUSE-SU-2024:12035-1"],"status":"published","title":"A flaw was found in htmldoc commit 31f7804. A heap buffer overflow in the function...","description":"A flaw was found in htmldoc commit 31f7804. A heap buffer overflow in the function pdf_write_names in ps-pdf.cxx may lead to arbitrary code execution and Denial of Service (DoS).","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01187,"percentile":0.68087,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2022-04-27T02:19:23Z","modified":"2026-11-03T08:01:27Z","fixes":[{"ecosystem":"Debian:12","package":"htmldoc","fixed_in":["1.9.15-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"htmldoc","fixed_in":["1.9.15-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"htmldoc","fixed_in":["1.9.15-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"htmldoc","fixed_in":["1.8.27-8ubuntu1+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"htmldoc","fixed_in":["1.8.27-8ubuntu1.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"htmldoc","fixed_in":["1.9.2-1ubuntu0.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"htmldoc","fixed_in":["1.9.7-1ubuntu0.3+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"htmldoc","fixed_in":["1.9.15-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"htmldoc","fixed_in":["1.9.15-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-8ubuntu1+esm4"}]}],"versions":["1.8.27-8ubuntu1","1.8.27-8ubuntu1+esm1","1.8.27-8ubuntu1+esm2","1.8.27-8ubuntu1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-8ubuntu1.1+esm3"}]}],"versions":["1.8.27-8ubuntu1","1.8.27-8ubuntu1.1","1.8.27-8ubuntu1.1+esm1","1.8.27-8ubuntu1.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-1ubuntu0.2+esm2"}]}],"versions":["1.8.27-8ubuntu2","1.8.27-8ubuntu3","1.9.2-1","1.9.2-1ubuntu0.1","1.9.2-1ubuntu0.2","1.9.2-1ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.7-1ubuntu0.3+esm2"}]}],"versions":["1.9.3-1","1.9.7-1","1.9.7-1build1","1.9.7-1ubuntu0.2","1.9.7-1ubuntu0.3","1.9.7-1ubuntu0.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-1ubuntu0.1~esm1"}]}],"versions":["1.9.11-4","1.9.12-1","1.9.13-1","1.9.14-1","1.9.15-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-8ubuntu1+esm4"}]}],"versions":["1.8.27-8ubuntu1","1.8.27-8ubuntu1+esm1","1.8.27-8ubuntu1+esm2","1.8.27-8ubuntu1+esm3"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-8ubuntu1.1+esm3"}]}],"versions":["1.8.27-8ubuntu1","1.8.27-8ubuntu1.1","1.8.27-8ubuntu1.1+esm1","1.8.27-8ubuntu1.1+esm2"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-1ubuntu0.2+esm2"}]}],"versions":["1.8.27-8ubuntu2","1.8.27-8ubuntu3","1.9.2-1","1.9.2-1ubuntu0.1","1.9.2-1ubuntu0.2","1.9.2-1ubuntu0.2+esm1"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.7-1ubuntu0.3+esm2"}]}],"versions":["1.9.3-1","1.9.7-1","1.9.7-1build1","1.9.7-1ubuntu0.2","1.9.7-1ubuntu0.3","1.9.7-1ubuntu0.3+esm1"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-1ubuntu0.1~esm1"}]}],"versions":["1.9.11-4","1.9.12-1","1.9.13-1","1.9.14-1","1.9.15-1"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.17-1ubuntu0.1~esm1"}]}],"versions":["1.9.16-1","1.9.17-1","1.9.17-1build2","1.9.17-1build3"],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"htmldoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-2.1"}]}]}],"products":[{"vendor":"htmldoc_project","product":"htmldoc"}],"references":[{"url":"https://github.com/michaelrsweet/htmldoc/issues/480","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/michaelrsweet/htmldoc/commit/46c8ec2b9bccb8ccabff52d998c5eee77a228348","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28085","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xhgj-p5p6-x24h"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/28xxx/CVE-2022-28085.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-28085","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-28085","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28085","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7225-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-0137","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-0534","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-24191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-27114","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-34033","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-34035","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45508","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-46478","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28085","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-28085","description":"A flaw was found in htmldoc commit 31f7804. A heap buffer overflow in the function pdf_write_names in ps-pdf.cxx may lead to arbitrary code execution and Denial of Service (DoS).","status":"published","published":"2022-04-27T02:19:23Z","modified":"2024-08-03T05:48:36.811Z","updated_at":"2026-11-02T14:34:39.233406Z"}],"euvd":[{"id":"EUVD-2022-32570","description":"A flaw was found in htmldoc commit 31f7804. A heap buffer overflow in the function pdf_write_names in ps-pdf.cxx may lead to arbitrary code execution and Denial of Service (DoS).","status":"published","published":"2022-04-27T02:19:23Z","modified":"2024-08-03T05:48:36Z","updated_at":"2026-11-03T03:25:41.471197Z"}],"ghsa":[{"id":"GHSA-xhgj-p5p6-x24h","title":"A flaw was found in htmldoc commit 31f7804. A heap buffer overflow in the function...","description":"A flaw was found in htmldoc commit 31f7804. A heap buffer overflow in the function pdf_write_names in ps-pdf.cxx may lead to arbitrary code execution and Denial of Service (DoS).","status":"published","published":"2022-04-28T00:00:35Z","modified":"2023-01-30T05:00:28Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:46:13.0899Z"}],"nvd":[{"id":"CVE-2022-28085","description":"A flaw was found in htmldoc commit 31f7804. A heap buffer overflow in the function pdf_write_names in ps-pdf.cxx may lead to arbitrary code execution and Denial of Service (DoS).","status":"published","published":"2022-04-27T03:15:39.65Z","modified":"2026-06-17T04:37:57.57Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:07:18.660414Z"}],"osv":[{"id":"DEBIAN-CVE-2022-28085","description":"A flaw was found in htmldoc commit 31f7804. A heap buffer overflow in the function pdf_write_names in ps-pdf.cxx may lead to arbitrary code execution and Denial of Service (DoS).","status":"published","published":"2022-04-27T03:15:39.65Z","modified":"2026-11-03T08:01:27.487523822Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T08:25:01.007408Z"},{"id":"UBUNTU-CVE-2022-28085","description":"A flaw was found in htmldoc commit 31f7804. A heap buffer overflow in the function pdf_write_names in ps-pdf.cxx may lead to arbitrary code execution and Denial of Service (DoS).","status":"published","published":"2022-04-27T03:15:00Z","modified":"2026-02-04T03:25:42.703641Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"CVE-2022-28085","description":"A flaw was found in htmldoc commit 31f7804. A heap buffer overflow in the function pdf_write_names in ps-pdf.cxx may lead to arbitrary code execution and Denial of Service (DoS).","status":"published","published":"2022-04-27T02:19:23Z","modified":"2026-10-28T10:28:40.463859254Z","updated_at":"2026-11-02T15:44:25.164673Z"},{"id":"openSUSE-SU-2024:12035-1","title":"htmldoc-1.9.15-2.1 on GA media","description":"These are all security issues fixed in the htmldoc-1.9.15-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:04:33.850181Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"USN-7225-1","title":"HTMLDOC vulnerabilities","description":"It was discovered that HTMLDOC incorrectly handled memory in the\nimage_set_mask, git_read_lzw, write_header and write_node functions, which\ncould lead to a heap buffer overflow. An attacker could possibly use this\nissue to cause a denial of service or execute arbitrary code. This issue\nonly affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and\nUbuntu 20.04 LTS. (CVE-2022-0137, CVE-2022-24191, CVE-2022-34033,\nCVE-2022-34035)\n\nIt was discovered that HTMLDOC incorrectly handled memory in the\ngif_get_code function, which could lead to a segmentation fault. If a\nuser or application were tricked into opening a crafted GIF file, an\nattacker could possibly use this issue to cause a denial of service.\nThis issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,\nUbuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-0534)\n\nIt was discovered that HTMLDOC did not perform proper bounds checks on\nimage dimensions when loading JPEG images, which could lead to a buffer\noverflow. If a user or application were tricked into opening a crafted\nJPEG image, an attacker could possibly use this issue to cause a denial\nof service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-27114)\n\nIt was discovered that HTMLDOC incorrectly handled memory in the\npdf_write_names function, which could lead to a heap buffer overflow. If\na user or application were tricked into opening a specially crafted file,\nan attacker could possibly use this issue to cause a denial of service or\nleak sensitive information. This issue only affected Ubuntu 14.04 LTS,\nUbuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.\n(CVE-2022-28085)\n\nIt was discovered that HTMLDOC could be made to write out of bounds when\nattempting to strip whitespace. An attacker could use this issue to cause\na denial of service or execute arbitrary code. (CVE-2024-45508)\n\nIt was discovered that HTMLDOC incorrectly handled memory in the parse_pre\nfunction, which could lead to a heap buffer overflow. If a user or\napplication were tricked into opening a specially crafted file, an attacker\ncould possibly use this issue to cause a denial of service or execute\narbitrary code. (CVE-2024-46478)\n","status":"published","published":"2025-01-22T23:44:08Z","modified":"2026-06-25T13:32:30.759739104Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}