PT-2021-8103 · Htmldoc+4 · Htmldoc+4

Chibataiki · Published 2021-01-26 · Updated 2025-01-08 · CVE-2021-23191

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions htmldoc versions 1.9.12 and earlier

Description A security issue is found in the image load jpeg() function of the image.cxx component, related to NULL pointer dereference errors. This issue may allow an attacker to access confidential data, compromise data integrity, and cause a denial of service.

Recommendations For htmldoc versions 1.9.12 and earlier, consider disabling the image load jpeg() function as a temporary workaround until a patch is available. Restrict access to the image.cxx component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2022-2627

ALT-PU-2022-2729

BDU:2024-07295

CVE-2021-23191

DLA-2700-1

DSA-4928-1

MGASA-2021-0332

USN-7189-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Ubuntu

Htmldoc

References · 35

• 🔥 https://github.com/michaelrsweet/htmldoc/issues/415 · Exploit
• https://github.com/michaelrsweet/htmldoc/commit/369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc · Patch
• https://ubuntu.com/security/CVE-2021-34119 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-23191 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2021-1126SE17 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-26948 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-23191 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-23191 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-43579 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1967022 · Patch
• https://ubuntu.com/security/notices/USN-7189-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-23158 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-23206 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23191 · Security Note
• https://osv.dev/vulnerability/DLA-2700-1 · Vendor Advisory