ALT-BU-2022-6201-1
Branch sisyphus_mipsel update bulletin.
Package htmldoc updated to version 1.9.16-alt1_git_929606c_0 for branch sisyphus_mipsel.
Closed vulnerabilities
BDU:2022-00209
Уязвимость программного обеспечения для преобразования веб-страницы htmldoc, связанная с целочисленным переполнением, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2021-20308
Integer overflow in the htmldoc 1.9.11 and before may allow attackers to execute arbitrary code and cause a denial of service that is similar to CVE-2017-9181.
- https://bugzilla.redhat.com/show_bug.cgi?id=1946289
- https://github.com/michaelrsweet/htmldoc/issues/423
- https://lists.debian.org/debian-lts-announce/2021/07/msg00000.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1946289
- https://github.com/michaelrsweet/htmldoc/issues/423
- https://lists.debian.org/debian-lts-announce/2021/07/msg00000.html
Modified: 2025-02-05
CVE-2021-23165
A flaw was found in htmldoc before v1.9.12. Heap buffer overflow in pspdf_prepare_outpages(), in ps-pdf.cxx may lead to execute arbitrary code and denial of service.
- https://bugzilla.redhat.com/show_bug.cgi?id=1967014
- https://github.com/michaelrsweet/htmldoc/commit/6e8a95561988500b5b5ae4861b3b0cbf4fba517f
- https://github.com/michaelrsweet/htmldoc/commit/6e8a95561988500b5b5ae4861b3b0cbf4fba517f.patch
- https://github.com/michaelrsweet/htmldoc/issues/413
- https://bugzilla.redhat.com/show_bug.cgi?id=1967014
- https://github.com/michaelrsweet/htmldoc/commit/6e8a95561988500b5b5ae4861b3b0cbf4fba517f
- https://github.com/michaelrsweet/htmldoc/commit/6e8a95561988500b5b5ae4861b3b0cbf4fba517f.patch
- https://github.com/michaelrsweet/htmldoc/issues/413
Modified: 2024-11-21
CVE-2021-23180
A flaw was found in htmldoc in v1.9.12 and before. Null pointer dereference in file_extension(),in file.c may lead to execute arbitrary code and denial of service.
- https://bugzilla.redhat.com/show_bug.cgi?id=1967041
- https://github.com/michaelrsweet/htmldoc/commit/19c582fb32eac74b57e155cffbb529377a9e751a
- https://github.com/michaelrsweet/htmldoc/issues/418
- https://ubuntu.com/security/CVE-2021-23180
- https://bugzilla.redhat.com/show_bug.cgi?id=1967041
- https://github.com/michaelrsweet/htmldoc/commit/19c582fb32eac74b57e155cffbb529377a9e751a
- https://github.com/michaelrsweet/htmldoc/issues/418
- https://ubuntu.com/security/CVE-2021-23180
Modified: 2024-11-21
CVE-2021-23191
A security issue was found in htmldoc v1.9.12 and before. A NULL pointer dereference in the function image_load_jpeg() in image.cxx may result in denial of service.
- https://bugzilla.redhat.com/show_bug.cgi?id=1967022
- https://github.com/michaelrsweet/htmldoc/commit/369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc
- https://github.com/michaelrsweet/htmldoc/issues/415
- https://ubuntu.com/security/CVE-2021-23191
- https://bugzilla.redhat.com/show_bug.cgi?id=1967022
- https://github.com/michaelrsweet/htmldoc/commit/369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc
- https://github.com/michaelrsweet/htmldoc/issues/415
- https://ubuntu.com/security/CVE-2021-23191
Modified: 2024-11-21
CVE-2021-23206
A flaw was found in htmldoc in v1.9.12 and prior. A stack buffer overflow in parse_table() in ps-pdf.cxx may lead to execute arbitrary code and denial of service.
- https://bugzilla.redhat.com/show_bug.cgi?id=1967028
- https://github.com/michaelrsweet/htmldoc/commit/ba61a3ece382389ae4482c7027af8b32e8ab4cc8
- https://github.com/michaelrsweet/htmldoc/issues/416
- https://ubuntu.com/security/CVE-2021-23206
- https://bugzilla.redhat.com/show_bug.cgi?id=1967028
- https://github.com/michaelrsweet/htmldoc/commit/ba61a3ece382389ae4482c7027af8b32e8ab4cc8
- https://github.com/michaelrsweet/htmldoc/issues/416
- https://ubuntu.com/security/CVE-2021-23206
Modified: 2024-05-06
CVE-2021-33235
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-34035. Reason: This candidate is a duplicate of CVE-2022-34035. Notes: All CVE users should reference CVE-2022-34035 instead of this candidate.
Modified: 2024-05-06
CVE-2021-33236
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-34033. Reason: This candidate is a duplicate of CVE-2022-34033. Notes: All CVE users should reference CVE-2022-34033 instead of this candidate.
Modified: 2024-11-21
CVE-2021-40985
A stack-based buffer under-read in htmldoc before 1.9.12, allows attackers to cause a denial of service via a crafted BMP image to image_load_bmp.
- https://github.com/michaelrsweet/htmldoc/commit/f12b9666e582a8e7b70f11b28e5ffc49ad625d43
- https://github.com/michaelrsweet/htmldoc/issues/444
- https://lists.debian.org/debian-lts-announce/2022/02/msg00022.html
- https://github.com/michaelrsweet/htmldoc/commit/f12b9666e582a8e7b70f11b28e5ffc49ad625d43
- https://github.com/michaelrsweet/htmldoc/issues/444
- https://lists.debian.org/debian-lts-announce/2022/02/msg00022.html
Modified: 2024-11-21
CVE-2021-43579
A stack-based buffer overflow in image_load_bmp() in HTMLDOC <= 1.9.13 results in remote code execution if the victim converts an HTML document linking to a crafted BMP file.
- https://github.com/michaelrsweet/htmldoc/commit/27d08989a5a567155d506ac870ae7d8cc88fa58b
- https://github.com/michaelrsweet/htmldoc/compare/v1.9.12...v1.9.13
- https://github.com/michaelrsweet/htmldoc/issues/453
- https://github.com/michaelrsweet/htmldoc/issues/456
- https://lists.debian.org/debian-lts-announce/2022/02/msg00022.html
- https://github.com/michaelrsweet/htmldoc/commit/27d08989a5a567155d506ac870ae7d8cc88fa58b
- https://github.com/michaelrsweet/htmldoc/compare/v1.9.12...v1.9.13
- https://github.com/michaelrsweet/htmldoc/issues/453
- https://github.com/michaelrsweet/htmldoc/issues/456
- https://lists.debian.org/debian-lts-announce/2022/02/msg00022.html
Modified: 2024-11-21
CVE-2022-0137
A heap buffer overflow in image_set_mask function of HTMLDOC before 1.9.15 allows an attacker to write outside the buffer boundaries.
Modified: 2024-11-21
CVE-2022-24191
In HTMLDOC 1.9.14, an infinite loop in the gif_read_lzw function can lead to a pointer arbitrarily pointing to heap memory and resulting in a buffer overflow.
- https://github.com/michaelrsweet/htmldoc/issues/470
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RPDZLHOMPSA2LBXXFTZ5UADZWGYYWH7/
- https://github.com/michaelrsweet/htmldoc/issues/470
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RPDZLHOMPSA2LBXXFTZ5UADZWGYYWH7/
Modified: 2024-11-21
CVE-2022-34035
HTMLDoc v1.9.12 and below was discovered to contain a heap overflow via e_node htmldoc/htmldoc/html.cxx:588.
- https://github.com/michaelrsweet/htmldoc/commit/a0014be47d614220db111b360fb6170ef6f3937e
- https://github.com/michaelrsweet/htmldoc/commit/ee778252faebb721afba5a081dd6ad7eaf20eef3
- https://github.com/michaelrsweet/htmldoc/issues/426
- https://github.com/michaelrsweet/htmldoc/commit/a0014be47d614220db111b360fb6170ef6f3937e
- https://github.com/michaelrsweet/htmldoc/commit/ee778252faebb721afba5a081dd6ad7eaf20eef3
- https://github.com/michaelrsweet/htmldoc/issues/426
Package mosquitto updated to version 1.6.15-alt2 for branch sisyphus_mipsel.
Closed bugs
Websockets && mosquitto