PT-2021-8107 · Htmldoc+3 · Htmldoc+3

Chibataiki · Published 2021-01-26 · Updated 2025-01-08 · CVE-2021-26259

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HTMLDOC version 1.9.12

Description The issue is related to a heap buffer overflow in the render table row() function, located in the ps-pdf.cxx component of the HTMLDOC tool. This overflow can lead to arbitrary code execution and denial of service, allowing an attacker to access confidential data, compromise its integrity, and disrupt service.

Recommendations For HTMLDOC version 1.9.12, consider disabling the render table row() function in ps-pdf.cxx as a temporary workaround to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2024-07299

CVE-2021-26259

DLA-2700-1

DSA-4928-1

MGASA-2021-0332

USN-7189-1

Affected Products

Astra Linux

Htmldoc

Linuxmint

Ubuntu

References · 32

• 🔥 https://github.com/michaelrsweet/htmldoc/issues/417 · Exploit
• https://github.com/michaelrsweet/htmldoc/commit/0ddab26a542c74770317b622e985c52430092ba5 · Patch
• https://ubuntu.com/security/CVE-2021-34119 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-23191 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-26259 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2021-1126SE17 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-26948 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0332.html · Security Note
• https://osv.dev/vulnerability/DSA-4928-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07299 · Security Note
• https://ubuntu.com/security/CVE-2021-43579 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-26259 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26259 · Security Note
• https://ubuntu.com/security/notices/USN-7189-1 · Vendor Advisory
• https://debian.org/security/2021/dsa-4928 · Vendor Advisory