{"id":"USN-7225-1","summary":"HTMLDOC vulnerabilities","details":"It was discovered that HTMLDOC incorrectly handled memory in the\nimage_set_mask, git_read_lzw, write_header and write_node functions, which\ncould lead to a heap buffer overflow. An attacker could possibly use this\nissue to cause a denial of service or execute arbitrary code. This issue\nonly affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and\nUbuntu 20.04 LTS. (CVE-2022-0137, CVE-2022-24191, CVE-2022-34033,\nCVE-2022-34035)\n\nIt was discovered that HTMLDOC incorrectly handled memory in the\ngif_get_code function, which could lead to a segmentation fault. If a\nuser or application were tricked into opening a crafted GIF file, an\nattacker could possibly use this issue to cause a denial of service.\nThis issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,\nUbuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-0534)\n\nIt was discovered that HTMLDOC did not perform proper bounds checks on\nimage dimensions when loading JPEG images, which could lead to a buffer\noverflow. If a user or application were tricked into opening a crafted\nJPEG image, an attacker could possibly use this issue to cause a denial\nof service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-27114)\n\nIt was discovered that HTMLDOC incorrectly handled memory in the\npdf_write_names function, which could lead to a heap buffer overflow. If\na user or application were tricked into opening a specially crafted file,\nan attacker could possibly use this issue to cause a denial of service or\nleak sensitive information. This issue only affected Ubuntu 14.04 LTS,\nUbuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.\n(CVE-2022-28085)\n\nIt was discovered that HTMLDOC could be made to write out of bounds when\nattempting to strip whitespace. An attacker could use this issue to cause\na denial of service or execute arbitrary code. (CVE-2024-45508)\n\nIt was discovered that HTMLDOC incorrectly handled memory in the parse_pre\nfunction, which could lead to a heap buffer overflow. If a user or\napplication were tricked into opening a specially crafted file, an attacker\ncould possibly use this issue to cause a denial of service or execute\narbitrary code. (CVE-2024-46478)\n","modified":"2026-02-10T04:46:29Z","published":"2025-01-22T23:44:08Z","related":["UBUNTU-CVE-2022-0137","UBUNTU-CVE-2022-0534","UBUNTU-CVE-2022-24191","UBUNTU-CVE-2022-27114","UBUNTU-CVE-2022-28085","UBUNTU-CVE-2022-34033","UBUNTU-CVE-2022-34035","UBUNTU-CVE-2024-45508","UBUNTU-CVE-2024-46478"],"upstream":["CVE-2022-0137","CVE-2022-0534","CVE-2022-24191","CVE-2022-27114","CVE-2022-28085","CVE-2022-34033","CVE-2022-34035","CVE-2024-45508","CVE-2024-46478","UBUNTU-CVE-2022-0137","UBUNTU-CVE-2022-0534","UBUNTU-CVE-2022-24191","UBUNTU-CVE-2022-27114","UBUNTU-CVE-2022-28085","UBUNTU-CVE-2022-34033","UBUNTU-CVE-2022-34035","UBUNTU-CVE-2024-45508","UBUNTU-CVE-2024-46478"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-7225-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2022-0137"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2022-0534"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2022-24191"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2022-27114"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2022-28085"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2022-34033"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2022-34035"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2024-45508"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2024-46478"}],"affected":[{"package":{"name":"htmldoc","ecosystem":"Ubuntu:Pro:14.04:LTS","purl":"pkg:deb/ubuntu/htmldoc@1.8.27-8ubuntu1+esm4?arch=source&distro=esm-infra-legacy/trusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-8ubuntu1+esm4"}]}],"versions":["1.8.27-8ubuntu1","1.8.27-8ubuntu1+esm1","1.8.27-8ubuntu1+esm2","1.8.27-8ubuntu1+esm3"],"ecosystem_specific":{"binaries":[{"binary_name":"htmldoc","binary_version":"1.8.27-8ubuntu1+esm4"},{"binary_name":"htmldoc-common","binary_version":"1.8.27-8ubuntu1+esm4"}],"availability":"Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"},"database_specific":{"cves_map":{"cves":[{"severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-0137"},{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-0534"},{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-24191"},{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-27114"},{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-28085"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-34033"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-34035"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2024-45508"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2024-46478"}],"ecosystem":"Ubuntu:Pro:14.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-7225-1.json"}},{"package":{"name":"htmldoc","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/htmldoc@1.8.27-8ubuntu1.1+esm3?arch=source&distro=esm-apps/xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.27-8ubuntu1.1+esm3"}]}],"versions":["1.8.27-8ubuntu1","1.8.27-8ubuntu1.1","1.8.27-8ubuntu1.1+esm1","1.8.27-8ubuntu1.1+esm2"],"ecosystem_specific":{"binaries":[{"binary_name":"htmldoc","binary_version":"1.8.27-8ubuntu1.1+esm3"},{"binary_name":"htmldoc-common","binary_version":"1.8.27-8ubuntu1.1+esm3"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"},"database_specific":{"cves_map":{"cves":[{"severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-0137"},{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-0534"},{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-24191"},{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-27114"},{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-28085"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-34033"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-34035"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2024-45508"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2024-46478"}],"ecosystem":"Ubuntu:Pro:16.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-7225-1.json"}},{"package":{"name":"htmldoc","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/htmldoc@1.9.2-1ubuntu0.2+esm2?arch=source&distro=esm-apps/bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2-1ubuntu0.2+esm2"}]}],"versions":["1.8.27-8ubuntu2","1.8.27-8ubuntu3","1.9.2-1","1.9.2-1ubuntu0.1","1.9.2-1ubuntu0.2","1.9.2-1ubuntu0.2+esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"htmldoc","binary_version":"1.9.2-1ubuntu0.2+esm2"},{"binary_name":"htmldoc-common","binary_version":"1.9.2-1ubuntu0.2+esm2"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"},"database_specific":{"cves_map":{"cves":[{"severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-0137"},{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-0534"},{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-24191"},{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-27114"},{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-28085"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-34033"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-34035"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2024-45508"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2024-46478"}],"ecosystem":"Ubuntu:Pro:18.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-7225-1.json"}},{"package":{"name":"htmldoc","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/htmldoc@1.9.7-1ubuntu0.3+esm2?arch=source&distro=esm-apps/focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.7-1ubuntu0.3+esm2"}]}],"versions":["1.9.3-1","1.9.7-1","1.9.7-1build1","1.9.7-1ubuntu0.2","1.9.7-1ubuntu0.3","1.9.7-1ubuntu0.3+esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"htmldoc","binary_version":"1.9.7-1ubuntu0.3+esm2"},{"binary_name":"htmldoc-common","binary_version":"1.9.7-1ubuntu0.3+esm2"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"},"database_specific":{"cves_map":{"cves":[{"severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-0137"},{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-0534"},{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-24191"},{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-27114"},{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-28085"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-34033"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-34035"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2024-45508"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2024-46478"}],"ecosystem":"Ubuntu:Pro:20.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-7225-1.json"}},{"package":{"name":"htmldoc","ecosystem":"Ubuntu:Pro:22.04:LTS","purl":"pkg:deb/ubuntu/htmldoc@1.9.15-1ubuntu0.1~esm1?arch=source&distro=esm-apps/jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.15-1ubuntu0.1~esm1"}]}],"versions":["1.9.11-4","1.9.12-1","1.9.13-1","1.9.14-1","1.9.15-1"],"ecosystem_specific":{"binaries":[{"binary_name":"htmldoc","binary_version":"1.9.15-1ubuntu0.1~esm1"},{"binary_name":"htmldoc-common","binary_version":"1.9.15-1ubuntu0.1~esm1"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"},"database_specific":{"cves_map":{"cves":[{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-27114"},{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-28085"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2024-45508"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2024-46478"}],"ecosystem":"Ubuntu:Pro:22.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-7225-1.json"}},{"package":{"name":"htmldoc","ecosystem":"Ubuntu:Pro:24.04:LTS","purl":"pkg:deb/ubuntu/htmldoc@1.9.17-1ubuntu0.1~esm1?arch=source&distro=esm-apps/noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.17-1ubuntu0.1~esm1"}]}],"versions":["1.9.16-1","1.9.17-1","1.9.17-1build2","1.9.17-1build3"],"ecosystem_specific":{"binaries":[{"binary_name":"htmldoc","binary_version":"1.9.17-1ubuntu0.1~esm1"},{"binary_name":"htmldoc-common","binary_version":"1.9.17-1ubuntu0.1~esm1"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"},"database_specific":{"cves_map":{"cves":[{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2024-45508"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2024-46478"}],"ecosystem":"Ubuntu:Pro:24.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-7225-1.json"}}],"schema_version":"1.7.3"}