PT-2021-8104 · Htmldoc+4 · Htmldoc+4

Chibataiki · Published 2021-01-26 · Updated 2025-01-08 · CVE-2021-23206

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions htmldoc versions 1.9.12 and prior

Description The issue is related to a stack buffer overflow in the parse table() function of the ps-pdf.cxx component. This can lead to arbitrary code execution and denial of service, allowing an attacker to access confidential data, compromise its integrity, and disrupt service.

Recommendations For versions 1.9.12 and prior, update to a version that fixes the stack buffer overflow in the parse table() function. As a temporary workaround, consider restricting access to the parse table() function in ps-pdf.cxx to minimize the risk of exploitation.

Exploit

Fix

DoS

Stack Overflow

Memory Corruption

Weakness Enumeration

CWE-121

CWE-787

Related Identifiers

ALT-PU-2022-2627

ALT-PU-2022-2729

BDU:2024-07296

CVE-2021-23206

DLA-2700-1

DSA-4928-1

MGASA-2021-0332

USN-7189-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Ubuntu

Htmldoc

References · 35

• 🔥 https://github.com/michaelrsweet/htmldoc/issues/416 · Exploit
• https://github.com/michaelrsweet/htmldoc/commit/ba61a3ece382389ae4482c7027af8b32e8ab4cc8 · Patch
• https://ubuntu.com/security/CVE-2021-34119 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-23191 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-23206 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2021-1126SE17 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07296 · Security Note
• https://ubuntu.com/security/CVE-2021-26948 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-23206 · Security Note
• https://ubuntu.com/security/CVE-2021-43579 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7189-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-23158 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23206 · Security Note
• https://ubuntu.com/security/CVE-2021-23206 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2700-1 · Vendor Advisory