CVE-2021-23158: Double Free
First published: Wed Jun 02 2021(Updated: )
A flaw was found in htmldoc in v1.9.12. Double-free in function pspdf_export(),in ps-pdf.cxx may result in a write-what-where condition, allowing an attacker to execute arbitrary code and denial of service. Reference: <a href="https://github.com/michaelrsweet/htmldoc/issues/414">https://github.com/michaelrsweet/htmldoc/issues/414</a> Upstream patch: <a href="https://github.com/michaelrsweet/htmldoc/commit/369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc">https://github.com/michaelrsweet/htmldoc/commit/369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Htmldoc Project Htmldoc | =1.9.12 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/michaelrsweet/htmldoc/issues/414
- https://github.com/michaelrsweet/htmldoc/commit/369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1967021
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1967020
- https://access.redhat.com/security/cve/CVE-2021-26252
- https://bugzilla.redhat.com/show_bug.cgi?id=1967018
Frequently Asked Questions
What is CVE-2021-23158?
CVE-2021-23158 is a vulnerability found in htmldoc v1.9.12 that allows an attacker to execute arbitrary code and cause denial of service.
How severe is CVE-2021-23158?
CVE-2021-23158 has a severity rating of 9.8 (Critical).
How does CVE-2021-23158 occur?
CVE-2021-23158 occurs due to a double-free vulnerability in the pspdf_export() function in ps-pdf.cxx, which leads to a write-what-where condition.
What is the affected software by CVE-2021-23158?
The affected software by CVE-2021-23158 is htmldoc v1.9.12.
How can I fix CVE-2021-23158?
To fix CVE-2021-23158, update htmldoc to a version that contains the fix or apply the patch provided by the vendor.
- collector/redhat-bugzilla
- alias/CVE-2021-23158
- collector/nvd-index
- vendor/htmldoc project
- canonical/htmldoc project htmldoc
- version/htmldoc project htmldoc/1.9.12