CVE-2021-23165: htmldoc_project htmldoc Heap-based Buffer Overflow
CVSS: 10.0v2.0HighAnalyzed
AliasesUBUNTU-CVE-2021-23165USN-5438-1USN-5438-2DEBIAN-CVE-2021-23165
Published 16-03-2022Last modified 03-08-2024
Vulnerability summary
CVE-2021-23165 is a high (CVSS 10.0) Heap-based Buffer Overflow vulnerability in htmldoc_project htmldoc. EPSS estimates a 3.51% chance of exploitation in the next 30 days, higher than 89.1% of scored vulnerabilities. 2 public exploits are recorded.
CVSS score
10.0/10
010
High · v2.0 (NVD)EPSS score
3.51%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2github, reference
Advisory lineage
Upstream 0 · Downstream 3Timeline
- 16-03-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in htmldoc before v1.9.12. Heap buffer overflow in pspdf_prepare_outpages(), in ps-pdf.cxx may lead to execute arbitrary code and denial of service.
CVSS metrics
4 scores · 3 sources · 2 versionsCritical 9.8Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
High 10.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:C/I:C/A:CSourcesSingle source
EPSS trend
Probability
3.51%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
0.00 pp
From 3.51% on 22-09-2026
22-09-202622-10-2026
EPSS score3.51%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundHtmldoc
Maturity: poc
Exploit Reference (bugzilla.redhat.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-122Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Debian1 product
- htmldoc< 1.9.11-4
Htmldoc_project1 product
- htmldoc< 1.9.12
Ubuntu1 product
- htmldoc< 1.9.2-1ubuntu0.2 | < 1.9.7-1ubuntu0.3 | < 1.8.27-8ubuntu1+esm2 | < 1.8.27-8ubuntu1.1+esm1
3 vendors · 3 products
References
10 links- github.com/michaelrsweet/htmldoc/issues/413X Refsource MISCREPORTExploitIssue TrackingThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=1967014X Refsource MISCExploitIssue TrackingPatchThird Party Advisory
- github.com/michaelrsweet/htmldoc/commit/6e8a95561988500b5b5ae4861b3b0cbf4fba517fX Refsource MISCPatchThird Party Advisory
- github.com/michaelrsweet/htmldoc/commit/6e8a95561988500b5b5ae4861b3b0cbf4fba517f.patchX Refsource MISCMailing ListThird Party Advisory
