Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Mageia: 2022-0033 Moderate: htmldoc Buffer Overflow Remote Code Execution

mageia
Calendar Grey January 25, 2022
Dist Mageia Esm H88
Mageia 2022-0033 upgrades htmldoc to resolve a critical crash issue and a serious buffer overflow vulnerability, allowing for potential remote code execution.
The updated packages fix a crash when clicking the button "Generate" and a security vulnerability: A stack-based buffer overflow in image_load_bmp() in HTMLDOC <= 1.9.13 results i...

Summary

The updated packages fix a crash when clicking the button "Generate" and a security vulnerability:
A stack-based buffer overflow in image_load_bmp() in HTMLDOC <= 1.9.13 results in remote code execution if the victim converts an HTML document linking to a crafted BMP file. (CVE-2021-43579)

References

- https://bugs.mageia.org/show_bug.cgi?id=29914

- https://lists.suse.com/pipermail/sle-security-updates/2022-January/010028.html

- https://www.cve.org/CVERecord?id=CVE-2021-43579

Topics%20covered

Topics Covered

security advisory buffer overflow remote code execution mageia html-doc

Resolution

SRPMS

- 8/core/htmldoc-1.9.14-1.mga8

Publication date: 25 Jan 2022
URL: https://advisories.mageia.org/MGASA-2022-0033.html
Type: security
CVE: CVE-2021-43579

Topics%20covered

Topics Covered

security advisory buffer overflow remote code execution mageia html-doc

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here