PT-2019-6156 · Htmldoc+2 · Htmldoc+2

Fcambus · Published 2019-12-08 · Updated 2023-02-01 · CVE-2019-19630

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions htmldoc version 1.9.7

Description The issue is related to a buffer overflow in the hd strlcpy() function, which can be exploited by a remote attacker to access confidential data, compromise data integrity, and cause a denial of service. This can occur when a crafted HTML document is processed.

Recommendations For htmldoc version 1.9.7, consider disabling the hd strlcpy() function as a temporary workaround until a patch is available. Restrict access to the render contents function in ps-pdf.cxx to minimize the risk of exploitation. Avoid using crafted HTML documents that can trigger the buffer overflow in the hd strlcpy() function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2022-00272

CVE-2019-19630

DLA-2026-1

DLA-2700-1

MGASA-2019-0403

SUSE-SU-2022:14898-1

USN-4696-1

Affected Products

Astra Linux

Ubuntu

Htmldoc

References · 33

• 🔥 https://github.com/michaelrsweet/htmldoc/issues/370 · Exploit
• https://osv.dev/vulnerability/DLA-2026-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:14898-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19630 · Security Note
• https://osv.dev/vulnerability/MGASA-2019-0403 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2021-1126SE17 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-19630 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-19630 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-19630 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2700-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0403.html · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FEUT3LG6DWTICKXYAN4SWOQWWCGHPLDJ · Vendor Advisory
• https://debian.org/lts/security/2019/dla-2026 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19630 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MZLVUBON5AYWYTFTJ4HBSHGTQTY7KBN · Vendor Advisory