PT-2021-8102 · Htmldoc+4 · Htmldoc+4

Chibataiki · Published 2021-01-26 · Updated 2022-10-04 · CVE-2021-23180

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions htmldoc versions 1.9.12 and earlier

Description The issue is related to a null pointer dereference in the file extension() function, located in the file.c component of the htmldoc tool. This can lead to arbitrary code execution and denial of service, allowing an attacker to access confidential data, compromise its integrity, and disrupt service.

Recommendations For versions 1.9.12 and earlier, update to a version that fixes the null pointer dereference issue in the file extension() function. As a temporary workaround, consider restricting access to the file extension() function in the file.c component to minimize the risk of exploitation.

Exploit

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2022-2627

ALT-PU-2022-2729

BDU:2024-07294

CVE-2021-23180

DLA-2700-1

DSA-4928-1

MGASA-2021-0332

USN-5198-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Ubuntu

Htmldoc

References · 25

• 🔥 https://github.com/michaelrsweet/htmldoc/issues/418 · Exploit
• https://github.com/michaelrsweet/htmldoc/commit/19c582fb32eac74b57e155cffbb529377a9e751a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-23180 · Security Note
• https://osv.dev/vulnerability/CVE-2021-23180 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-23180 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2021-1126SE17 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4928-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0332.html · Security Note
• https://osv.dev/vulnerability/USN-5198-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5198-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-23180 · Security Note
• https://ubuntu.com/security/CVE-2021-23180 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1967041 · Patch
• https://debian.org/security/2021/dsa-4928 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07294 · Security Note