Buffer overflow in the set_page_size function in util.cxx in HTMLDOC 1.8.27 and earlier allows context-dependent attackers to execute arbitrary code via a long MEDIA SIZE comment. NOTE: it was later reported that there were additional vectors in htmllib.cxx and ps-pdf.cxx using an AFM font file with a long glyph name, but these vectors do not cross privilege boundaries.

Specially crafted files could cause a buffer overflow in htmldoc (CVE-2009-3050).

A security vulnerability has been identified and fixed in htmldoc :

Buffer overflow in the set_page_size function in util.cxx in HTMLDOC 1.8.27 and earlier allows context-dependent attackers to execute arbitrary code via a long MEDIA SIZE comment. NOTE: it was later reported that there were additional vectors in htmllib.cxx and ps-pdf.cxx using an AFM font file with a long glyph name, but these vectors do not cross privilege boundaries (CVE-2009-3050).

This update provides a solution to this vulnerability.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

The remote host is affected by the vulnerability described in GLSA-200909-12 (HTMLDOC: User-assisted execution of arbitrary code)

    ANTHRAX666 reported an insecure call to the sscanf() function in the     set_page_size() function in htmldoc/util.cxx. Nico Golde of the Debian     Security Team found two more insecure calls in the write_type1()     function in htmldoc/ps-pdf.cxx and the htmlLoadFontWidths() function in     htmldoc/htmllib.cxx.
  Impact :

    A remote attacker could entice a user to process a specially crafted     HTML file using htmldoc, possibly resulting in the execution of     arbitrary code with the privileges of the user running the application.
    NOTE: Additional vectors via specially crafted AFM font metric files do     not cross trust boundaries, as the files can only be modified by     privileged users.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
43385	openSUSE Security Update : htmldoc (htmldoc-1682)	Nessus	SuSE Local Security Checks	critical
43382	openSUSE Security Update : htmldoc (htmldoc-1682)	Nessus	SuSE Local Security Checks	critical
43380	openSUSE Security Update : htmldoc (htmldoc-1682)	Nessus	SuSE Local Security Checks	critical
40967	Mandriva Linux Security Advisory : htmldoc (MDVSA-2009:231-1)	Nessus	Mandriva Local Security Checks	critical
40959	GLSA-200909-12 : HTMLDOC: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2009-3050

critical

Tenable Plugins

critical

critical

critical

critical

critical