USN-7225-1: HTMLDOC vulnerabilities
It was discovered that HTMLDOC incorrectly handled memory in the imagesetmask, gitreadlzw, writeheader and writenode functions, which could lead to a heap buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-0137, CVE-2022-24191, CVE-2022-34033, CVE-2022-34035) It was discovered that HTMLDOC incorrectly handled memory in the gifgetcode function, which could lead to a segmentation fault. If a user or application were tricked into opening a crafted GIF file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-0534) It was discovered that HTMLDOC did not perform proper bounds checks on image dimensions when loading JPEG images, which could lead to a buffer overflow. If a user or application were tricked into opening a crafted JPEG image, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-27114) It was discovered that HTMLDOC incorrectly handled memory in the pdfwritenames function, which could lead to a heap buffer overflow. If a user or application were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service or leak sensitive information. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-28085) It was discovered that HTMLDOC could be made to write out of bounds when attempting to strip whitespace. An attacker could use this issue to cause a denial of service or execute arbitrary code. (CVE-2024-45508) It was discovered that HTMLDOC incorrectly handled memory in the parsepre function, which could lead to a heap buffer overflow. If a user or application were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2024-46478)
Affected Software
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the severity of USN-7225-1?
USN-7225-1 has been classified as a high severity vulnerability due to the potential for heap buffer overflow exploits.
How do I fix USN-7225-1?
To fix USN-7225-1, update the htmldoc package to the recommended version that corresponds with your Ubuntu release.
Which versions of Ubuntu are affected by USN-7225-1?
USN-7225-1 affects multiple Ubuntu versions, including 14.04 through 24.10, depending on the installed htmldoc package version.
What potential impacts does USN-7225-1 have?
The impacts of USN-7225-1 include the risk of denial of service or the execution of arbitrary code.
What components are involved in the USN-7225-1 vulnerability?
USN-7225-1 involves the htmldoc functions such as image_set_mask, git_read_lzw, write_header, and write_node.