CVE-2009-3050: Buffer overflow in the set_page_size function in util.cxx in HTMLDOC 1.8.27 and earlier allows context-dependent attackers to execute arbitrary code via a long MEDIA SIZE comment | LiveThreat CVE Feed — Verisq

Login Request a demo

Unscored severity · published Sep 2, 2009

CVE-2009-3050

Buffer overflow in the set_page_size function in util.cxx in HTMLDOC 1.8.27 and earlier allows context-dependent attackers to execute arbitrary code via a long MEDIA SIZE comment

–

CVSS

4.4%

EPSS

No

On KEV

Description

Buffer overflow in the set_page_size function in util.cxx in HTMLDOC 1.8.27 and earlier allows context-dependent attackers to execute arbitrary code via a long MEDIA SIZE comment. NOTE: it was later reported that there were additional vectors in htmllib.cxx and ps-pdf.cxx using an AFM font file with a long glyph name, but these vectors do not cross privilege boundaries.

Exploitation

Is it being used?

Exploit prediction (EPSS)4.4% · higher than 91% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

HT

Htmldoc · Htmldoc

through 1.8.27; 1.8.24; 1.8.25; 1.8.26 · source: NVD

Affected product

HT

Htmldoc

Htmldoc

All Htmldoc CVEs

References

https://nvd.nist.gov/vuln/detail/CVE-2009-3050

https://www.cve.org/CVERecord?id=CVE-2009-3050

http://bugs.gentoo.org/show_bug.cgi?id=278186

http://packetstormsecurity.org/0907-exploits/htmldoc-overflow.txt

Vendor Advisory

http://secunia.com/advisories/35780

http://www.htmldoc.org/str.php?L214

www.openwall.com

http://www.openwall.com/lists/oss-security/2009/07/25/3

www.openwall.com

http://www.openwall.com/lists/oss-security/2009/07/26/2

More from Htmldoc

9.8

HTMLDOC before 1.9.19 has an out-of-bounds write in parse_paragraph in ps-pdf.cxx because of an attempt to strip leading whitespace from a whitespace-only node