PT-2021-23884 · Htmldoc+5 · Htmldoc+5

Voiddy-Devo · Published 2021-11-12 · Updated 2025-01-08 · CVE-2021-43579

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HTMLDOC versions prior to 1.9.14

Description A stack-based buffer overflow in the image load bmp() function results in remote code execution if the victim converts an HTML document linking to a crafted BMP file.

Recommendations For versions prior to 1.9.14, update to version 1.9.14 or later to resolve the issue.

Exploit

Fix

RCE

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2022-2627

ALT-PU-2022-2729

CVE-2021-43579

DLA-2928-1

MGASA-2022-0033

OPENSUSE-SU-2022_0043-1

OPENSUSE-SU-2022_0088-1

OPENSUSE-SU-2024:11741-1

SUSE-SU-2022:14877-1

USN-7189-1

Affected Products

Alt Linux

Astra Linux

Htmldoc

Linuxmint

Suse

Ubuntu

References · 35

• 🔥 https://github.com/michaelrsweet/htmldoc/issues/453 · Exploit
• 🔥 https://github.com/michaelrsweet/htmldoc/issues/456 · Exploit
• 🔥 https://exploit-db.com/exploits/52425 · Exploit
• https://github.com/michaelrsweet/htmldoc/commit/27d08989a5a567155d506ac870ae7d8cc88fa58b · Patch
• https://osv.dev/vulnerability/CVE-2021-43579 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-43579 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-43579 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-26948 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-34121 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-26252 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:14877-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11741-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7189-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-23206 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-34119 · Vendor Advisory