Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in HTMLDOC
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in HTMLDOC
ID: USN-7225-1
Distribution: Ubuntu
Plattformen: Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 24.10
Datum: Fr, 24. Januar 2025, 06:49
Referenzen: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34035
https://launchpad.net/ubuntu/+source/htmldoc/1.9.18-1ubuntu0.1
https://ubuntu.com/security/notices/USN-7225-1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27114
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24191
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34033
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28085
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0534
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0137
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-46478
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45508
Applikationen: htmldoc

Originalnachricht

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============2195775843226805948==
Content-Language: en-US
Content-Type: multipart/signed; micalg=pgp-sha256;
protocol="application/pgp-signature";
boundary="------------0xVTMk8jwY5dFgfGDWuhVTlJ"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--------------0xVTMk8jwY5dFgfGDWuhVTlJ
Content-Type: multipart/mixed;
boundary="------------pkdPBOAnsNZyUDHFaLGBmb0R";
protected-headers="v1"
From: Bruce Cable <bruce.cable@canonical.com>
Reply-To: Ubuntu Security <security@ubuntu.com>
To: ubuntu-security-announce@lists.ubuntu.com
Message-ID: <1e10e357-b67b-4af3-be9c-1f6921ac83bf@canonical.com>
Subject: [USN-7225-1] HTMLDOC vulnerabilities

--------------pkdPBOAnsNZyUDHFaLGBmb0R
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: base64

==========================================================================
Ubuntu Security Notice USN-7225-1
January 22, 2025

HTMLDOC vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in htmldoc.

Software Description:
- htmldoc: HTML processor that generates indexed HTML, PS, and PDF

Details:

It was discovered that HTMLDOC incorrectly handled memory in the
image_set_mask, git_read_lzw, write_header and write_node functions, which
could lead to a heap buffer overflow. An attacker could possibly use this
issue to cause a denial of service or execute arbitrary code. This issue
only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and
Ubuntu 20.04 LTS. (CVE-2022-0137, CVE-2022-24191, CVE-2022-34033,
CVE-2022-34035)

It was discovered that HTMLDOC incorrectly handled memory in the
gif_get_code function, which could lead to a segmentation fault. If a
user or application were tricked into opening a crafted GIF file, an
attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-0534)

It was discovered that HTMLDOC did not perform proper bounds checks on
image dimensions when loading JPEG images, which could lead to a buffer
overflow. If a user or application were tricked into opening a crafted
JPEG image, an attacker could possibly use this issue to cause a denial
of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-27114)

It was discovered that HTMLDOC incorrectly handled memory in the
pdf_write_names function, which could lead to a heap buffer overflow. If
a user or application were tricked into opening a specially crafted file,
an attacker could possibly use this issue to cause a denial of service or
leak sensitive information. This issue only affected Ubuntu 14.04 LTS,
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
(CVE-2022-28085)

It was discovered that HTMLDOC could be made to write out of bounds when
attempting to strip whitespace. An attacker could use this issue to cause
a denial of service or execute arbitrary code. (CVE-2024-45508)

It was discovered that HTMLDOC incorrectly handled memory in the parse_pre
function, which could lead to a heap buffer overflow. If a user or
application were tricked into opening a specially crafted file, an attacker
could possibly use this issue to cause a denial of service or execute
arbitrary code. (CVE-2024-46478)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.10
  htmldoc                         1.9.18-1ubuntu0.1

Ubuntu 24.04 LTS
  htmldoc                         1.9.17-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 22.04 LTS
  htmldoc                         1.9.15-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 20.04 LTS
  htmldoc                         1.9.7-1ubuntu0.3+esm2
                                  Available with Ubuntu Pro

Ubuntu 18.04 LTS
  htmldoc                         1.9.2-1ubuntu0.2+esm2
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  htmldoc                         1.8.27-8ubuntu1.1+esm3
                                  Available with Ubuntu Pro

Ubuntu 14.04 LTS
  htmldoc                         1.8.27-8ubuntu1+esm4
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-7225-1
  CVE-2022-0137, CVE-2022-0534, CVE-2022-24191, CVE-2022-27114,
  CVE-2022-28085, CVE-2022-34033, CVE-2022-34035, CVE-2024-45508,
  CVE-2024-46478

Package Information:
https://launchpad.net/ubuntu/+source/htmldoc/1.9.18-1ubuntu0.1

--------------pkdPBOAnsNZyUDHFaLGBmb0R--

--------------0xVTMk8jwY5dFgfGDWuhVTlJ
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature.asc"

-----BEGIN PGP SIGNATURE-----

wsD5BAABCAAjFiEEkd98mdFcnQdP7vQkuGrtzot7pOcFAmeSwAIFAwAAAAAACgkQuGrtzot7pOdP
Swv+OxgXks/hTyLYkd9d9YWEjTioU2V9AOKgxpxWKNrVpD5jJRBoV4jDnbxpXss5bZpoC4mxYavk
NX8IhQKlPpF+2osxXUbuzNPac0bT5CecxDYN0SK6x5ltS8YSpgSIrylgMINDo/DGBrpM1CzAW5WI
7PE60ce05gbLTmlTJZlshka9QNC1PEWhzlK9ObtdERObvbmV0N1olpP3OOmqIXe5mPc4A0FsmKsR
2cIu0VMQg3Shly9QjFCgXwMckioW0ws8rgWti06wnQfo5pO+Xe2DLfjoB9q7eGILBWlgcPxAyJOE
0UZAlEUg/SMYky9+vZoPvK0408i6fDPaoofKp8Gav5VbhN83EjkLG8ANIiNsE5+1pWLr2d5e1nQl
7ep8isC0OIrsSgGIhEcXur2J2HUV6bT9eVHVnzPERKrgKxrDNy1Y2AA9Cl7T+mqVDvfcOX4GwV08
/GUFx81kxi+MCHWnadwlOKzpwGdhAMxy+YjcPCg1fW50Uads2AymgiHunrqz
=4D/b
-----END PGP SIGNATURE-----

--------------0xVTMk8jwY5dFgfGDWuhVTlJ--


--===============2195775843226805948==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

Cg==

--===============2195775843226805948==--
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung