CVE-2021-40985: Medium severity htmldoc vulnerability
A stack-based buffer under-read in htmldoc before 1.9.12, allows attackers to cause a denial of service via a crafted BMP image to imageloadbmp.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-40985?
CVE-2021-40985 is a vulnerability in htmldoc before version 1.9.12 that allows attackers to cause a denial of service via a crafted BMP image.
What is the severity of CVE-2021-40985?
The severity of CVE-2021-40985 is medium, with a CVSS score of 5.5.
What software is affected by CVE-2021-40985?
The Htmldoc software version up to exclusive version 1.9.12 and Debian Linux version 9.0 are affected by CVE-2021-40985.
How can an attacker exploit CVE-2021-40985?
An attacker can exploit CVE-2021-40985 by sending a crafted BMP image to the 'image_load_bmp' function in htmldoc, causing a stack-based buffer under-read and resulting in a denial of service.
Are there any references for CVE-2021-40985?
Yes, you can refer to the following links for more information on CVE-2021-40985: [GitHub commit](https://github.com/michaelrsweet/htmldoc/commit/f12b9666e582a8e7b70f11b28e5ffc49ad625d43), [GitHub issue](https://github.com/michaelrsweet/htmldoc/issues/444), [Debian advisory](https://lists.debian.org/debian-lts-announce/2022/02/msg00022.html).