[USN-7189-1] HTMLDOC vulnerabilities

[Bruce Cable]

==========================================================================
Ubuntu Security Notice USN-7189-1
January 08, 2025

HTMLDOC vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in HTMLDOC.

Software Description:
- htmldoc: HTML processor that generates indexed HTML, PS, and PDF

Details:

It was discovered that HTMLDOC incorrectly handled certain inputs, which
could lead to an integer overflow. An attacker could potentially use this
issue to cause a denial of service or execute arbitrary code.
(CVE-2021-20308)

It was discovered that HTMLDOC incorrectly handled memory in pspdf_export,
which could lead to a double-free. An attacker could potentially use this
issue to cause a denial of service or execute arbitrary code.
(CVE-2021-23158)

It was discovered that HTMLDOC incorrectly handled memory when loading a
JPEG image, which could lead to a NULL pointer dereference. An attacker
could potentially use this issue to cause a denial of service.
(CVE-2021-23191, CVE-2021-26948)

It was discovered that HTMLDOC incorrectly handled certain inputs, which
could lead to a stack buffer overflow. An attacker could potentially use
this issue to cause a denial of service or execute arbitrary code.
(CVE-2021-23206, CVE-2021-40985, CVE-2021-43579)

It was discovered that HTMLDOC incorrectly handled memory in
pdpdf_prepare_page and render_table_row, which could lead to a heap buffer
overflow. An attacker could potentially use this issue to cause a denial
of service or execute arbitrary code. (CVE-2021-26252, CVE-2021-26259)

It was discovered that HTMLDOC incorrectly handled memory in
parse_paragraph, which could lead to a heap buffer overflow. An attacker
could potentially use this issue to cause a denial of service or execute
arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-34119)

It was discovered that HTMLDOC incorrectly handled memory in parse_tree.
An attacker could potentially use this issue to leak sensitive
information. (CVE-2021-34121)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS
   htmldoc                         1.9.7-1ubuntu0.3+esm1
                                   Available with Ubuntu Pro

Ubuntu 18.04 LTS
   htmldoc                         1.9.2-1ubuntu0.2+esm1
                                   Available with Ubuntu Pro

Ubuntu 16.04 LTS
   htmldoc                         1.8.27-8ubuntu1.1+esm2
                                   Available with Ubuntu Pro

Ubuntu 14.04 LTS
   htmldoc                         1.8.27-8ubuntu1+esm3
                                   Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-7189-1
   CVE-2021-20308, CVE-2021-23158, CVE-2021-23191, CVE-2021-23206,
   CVE-2021-26252, CVE-2021-26259, CVE-2021-26948, CVE-2021-34119,
   CVE-2021-34121, CVE-2021-40985, CVE-2021-43579
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 665 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20250108/d5179647/attachment-0001.sig>