Heap Buffer Overflow in HTMLDOC Package - CVE-2022-0137
Summary
DEBIAN-CVE-2022-0137: A heap buffer overflow in image_set_mask function of HTMLDOC before 1.9.15 allows an attacker to write outside the buffer boundaries. Affects htmldoc versions < 1.9.15-1. Fixed in 1.9.15-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HTMLDOC is a tool that converts HTML documents into various formats such as PDF and PostScript. It is widely used for generating documentation from web content. The package is known for its ability to handle complex HTML structures and produce high-quality outputs. However, it has been identified to have a vulnerability that could lead to severe security risks if not addressed.
Vulnerability Detail
A heap buffer overflow in the image_set_mask function of HTMLDOC versions prior to 1.9.15 allows an attacker to write outside the buffer boundaries. This vulnerability can be exploited to execute arbitrary code, potentially compromising the system's integrity and confidentiality. The issue arises from improper handling of memory allocation, which can lead to data corruption and unauthorized access.
How To Fix
Minimum fixed version
1.9.15-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade htmldocTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of the HTMLDOC tool by restricting access to it or by using alternative tools for document conversion until the package is updated.
Conclusion
The heap buffer overflow vulnerability in the HTMLDOC package (CVE-2022-0137) poses significant security risks. Users are strongly encouraged to update to the latest version to mitigate these risks. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for htmldoc →
FAQ
CVE-2022-0137 is a security vulnerability in the HTMLDOC package that allows for a heap buffer overflow, potentially leading to arbitrary code execution.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The risks include potential unauthorized access to system resources, data corruption, and the ability for attackers to execute arbitrary code on the affected system.
Yes, a patch is available in version 1.9.15-1 of the HTMLDOC package. Users are advised to update to this version or later.
If immediate updates are not possible, consider restricting access to the HTMLDOC tool and using alternative document conversion methods until the update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for htmldoc.
