CVE-2009-3050: Buffer Overflow
First published: Wed Sep 02 2009(Updated: )
Buffer overflow in the set_page_size function in util.cxx in HTMLDOC 1.8.27 and earlier allows context-dependent attackers to execute arbitrary code via a long MEDIA SIZE comment. NOTE: it was later reported that there were additional vectors in htmllib.cxx and ps-pdf.cxx using an AFM font file with a long glyph name, but these vectors do not cross privilege boundaries.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Htmldoc | =1.8.26 | |
| Htmldoc | <=1.8.27 | |
| Htmldoc | =1.8.24 | |
| Htmldoc | =1.8.25 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2009/07/25/3
- http://packetstormsecurity.org/0907-exploits/htmldoc-overflow.txt
- http://www.openwall.com/lists/oss-security/2009/07/26/2
- http://www.openwall.com/lists/oss-security/2009/09/01/1
- http://bugs.gentoo.org/show_bug.cgi?id=278186
- http://secunia.com/advisories/35780
- http://www.htmldoc.org/str.php?L214
Frequently Asked Questions
What is the severity of CVE-2009-3050?
CVE-2009-3050 has a high severity rating due to the potential for arbitrary code execution.
How do I fix CVE-2009-3050?
To fix CVE-2009-3050, upgrade to HTMLDOC version 1.8.28 or later to mitigate the buffer overflow vulnerability.
What versions of HTMLDOC are affected by CVE-2009-3050?
CVE-2009-3050 affects HTMLDOC versions 1.8.27 and earlier, including 1.8.26, 1.8.25, and 1.8.24.
What type of attack is demonstrated in CVE-2009-3050?
CVE-2009-3050 demonstrates a buffer overflow attack that can allow context-dependent attackers to execute arbitrary code.
Are there any known exploits for CVE-2009-3050?
Yes, there are known exploits for CVE-2009-3050 that target the vulnerability caused by long MEDIA SIZE comments.
- agent/type
- agent/softwarecombine
- agent/weakness
- agent/severity
- agent/author
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/htmldoc
- canonical/htmldoc
- version/htmldoc/1.8.26
- version/htmldoc/1.8.27
- version/htmldoc/1.8.24
- version/htmldoc/1.8.25