[USN-7189-1] HTMLDOC vulnerabilities

-----BEGIN PGP SIGNATURE-----

wsD5BAABCAAjFiEEkd98mdFcnQdP7vQkuGrtzot7pOcFAmd9+5QFAwAAAAAACgkQuGrtzot7pOfK
nwwAyhTCIykbYA1DTaSY1X43ZPYSXAGIgBfCwswqCzSoUpKSgSPaDjWkVL9LXhhcg5v08p5hsuEl
Y0gYAT+euaguYSmSyLP5cu+d7QtKqit4haV1btNNFg/yg8jliduCkK7x/EYSBBo/xt8VL2mxG1/u
RSwf9zTANYMvXLKDeh7mAu3HQALaB72z/ylRYSW9Z3XxLHkEwM2v8L1nzwPa0UL5qtp2Decbbz2e
1nyc1hewIMNho4v3v9K8oBx5VhiZrd8qKF1OeBjEv35WU/rCwalkkPARDDbO//2FtHwMZmtXySv9
6YBHQajk2W6uY5hG0QFNaH5q3qmxDw3xQRGe5zJtTObFjVQw1HEpoaPDlmA+cq50J+b5peiCYEHD
oQXwOPKfKB7+DtxIKG0NAS0DR+S4ZhihH2NixrJoueXWq6L+YleAkFVMJ5ND5jsPxlozhLYSkl8M
xEAvNtFWbFieGDxpZvaMfAjrxqAUhF5W8M2BTuGcMgiWL0aaGiehfdjGj+U1
=Pp5l
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7189-1
January 08, 2025

HTMLDOC vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in HTMLDOC.

Software Description:
- htmldoc: HTML processor that generates indexed HTML, PS, and PDF

Details:

It was discovered that HTMLDOC incorrectly handled certain inputs, which
could lead to an integer overflow. An attacker could potentially use this
issue to cause a denial of service or execute arbitrary code.
(CVE-2021-20308)

It was discovered that HTMLDOC incorrectly handled memory in pspdf_export,
which could lead to a double-free. An attacker could potentially use this
issue to cause a denial of service or execute arbitrary code.
(CVE-2021-23158)

It was discovered that HTMLDOC incorrectly handled memory when loading a
JPEG image, which could lead to a NULL pointer dereference. An attacker
could potentially use this issue to cause a denial of service.
(CVE-2021-23191, CVE-2021-26948)

It was discovered that HTMLDOC incorrectly handled certain inputs, which
could lead to a stack buffer overflow. An attacker could potentially use
this issue to cause a denial of service or execute arbitrary code.
(CVE-2021-23206, CVE-2021-40985, CVE-2021-43579)

It was discovered that HTMLDOC incorrectly handled memory in
pdpdf_prepare_page and render_table_row, which could lead to a heap buffer
overflow. An attacker could potentially use this issue to cause a denial
of service or execute arbitrary code. (CVE-2021-26252, CVE-2021-26259)

It was discovered that HTMLDOC incorrectly handled memory in
parse_paragraph, which could lead to a heap buffer overflow. An attacker
could potentially use this issue to cause a denial of service or execute
arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-34119)

It was discovered that HTMLDOC incorrectly handled memory in parse_tree.
An attacker could potentially use this issue to leak sensitive
information. (CVE-2021-34121)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS
  htmldoc                         1.9.7-1ubuntu0.3+esm1
                                  Available with Ubuntu Pro

Ubuntu 18.04 LTS
  htmldoc                         1.9.2-1ubuntu0.2+esm1
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  htmldoc                         1.8.27-8ubuntu1.1+esm2
                                  Available with Ubuntu Pro

Ubuntu 14.04 LTS
  htmldoc                         1.8.27-8ubuntu1+esm3
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-7189-1
  CVE-2021-20308, CVE-2021-23158, CVE-2021-23191, CVE-2021-23206,
  CVE-2021-26252, CVE-2021-26259, CVE-2021-26948, CVE-2021-34119,
  CVE-2021-34121, CVE-2021-40985, CVE-2021-43579