CVE-2021-43579

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 10-01-2022 03:10

Last modified: - 01-04-2022 05:20

Total changes: - 4

Description

A stack-based buffer overflow in image_load_bmp() in HTMLDOC <= 1.9.13 results in remote code execution if the victim converts an HTML document linking to a crafted BMP file.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Low

Attack complexity

Local

Attack vector

High

Availability

High

Confidentiality

High

Integrity

None

Privileges required

Unchanged

Scope

Required

User interaction

7.8

Base score

1.8

5.9

Exploitability score

Impact score

Verification logic

vendor=htmldoc_project AND product=htmldoc AND versionEndIncluding=1.9.13

vendor=Debian AND product=debian_linux AND version=9.0

Reference

https://github.com/michaelrsweet/htmldoc/issues/453
https://github.com/michaelrsweet/htmldoc/compare/v1.9.12...v1.9.13
https://github.com/michaelrsweet/htmldoc/commit/27d08989a5a567155d506ac870ae7d8cc88fa58b
https://github.com/michaelrsweet/htmldoc/issues/456
[debian-lts-announce] 20220226 [SECURITY] [DLA 2928-1] htmldoc security update-Mailing List, Third Party Advisory

Keywords

CVE-2021-43579

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2021-43579

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures