Double-Free Vulnerability in htmldoc Package
Summary
CVE-2021-23158: A flaw was found in htmldoc in v1.9.12. Affects htmldoc across 2 version ranges.
< 1.9.11-4
< 369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc
Fixed in 1.9.11-4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The htmldoc package is a tool for converting HTML files into PDF or PostScript format. It is commonly used for generating PDF documents from HTML content. The package provides various features and options for customizing the output format. However, a vulnerability has been discovered in version 1.9.12 of htmldoc, which can lead to a double-free condition in the pspdf_export() function in ps-pdf.cxx. This vulnerability allows an attacker to execute arbitrary code and potentially cause a denial of service.
Vulnerability Detail
The double-free vulnerability in htmldoc arises due to improper memory management in the pspdf_export() function. When certain conditions are met, this flaw can be exploited to trigger a write-what-where condition. An attacker can craft a malicious input that exploits this vulnerability and execute arbitrary code within the context of the vulnerable application. This can lead to various consequences, including remote code execution, privilege escalation, and unauthorized access to sensitive information. The severity of this vulnerability is rated as critical with a CVSS score of 9.8.
How To Fix
Minimum fixed version
1.9.11-4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade htmldocTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix by updating the htmldoc package to the recommended version.
Conclusion
The double-free vulnerability in the htmldoc package can lead to arbitrary code execution and denial of service. It is crucial for users to update their installations to the fixed version to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for htmldoc →
FAQ
htmldoc is a package used for converting HTML files into PDF or PostScript format.
This vulnerability can allow an attacker to execute arbitrary code and potentially cause a denial of service.
To fix this vulnerability, update the htmldoc package to version 1.9.11-4 or later.
No, there is no known workaround for this vulnerability. Updating the package is the recommended solution.
The severity of this vulnerability is rated as critical with a CVSS score of 9.8.
Related vulnerabilities
Recent vulnerabilities recorded for htmldoc.
