← Back to branch summary

~ubuntu-security/ubuntu-cve-tracker/master

« back to all changes in this revision

Viewing changes to retired/CVE-2009-3050

  • Committer: Steve Beattie
  • Date: 2019-02-19 06:18:27 UTC
  • Revision ID: sbeattie@ubuntu.com-20190219061827-oh57fzcfc1u9dlfk
The ubuntu-cve-tracker project has been converted to git.

Please use 'git clone https://git.launchpad.net/ubuntu-cve-tracker' to
get the converted tree.

Show diffs side-by-side

added added

removed removed

Lines of Context:
retired/CVE-2009-3050
1
 
Candidate: CVE-2009-3050
2
 
PublicDate: 2009-09-02
3
 
References:
4
 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3050
5
 
Description:
6
 
 Buffer overflow in the set_page_size function in util.cxx in HTMLDOC 1.8.27
7
 
 and earlier allows context-dependent attackers to execute arbitrary code
8
 
 via a long MEDIA SIZE comment.  NOTE: it was later reported that there were
9
 
 additional vectors in htmllib.cxx and ps-pdf.cxx using an AFM font file
10
 
 with a long glyph name, but these vectors do not cross privilege
11
 
 boundaries.
12
 
Ubuntu-Description:
13
 
Notes:
14
 
 mdeslaur> PoC: http://packetstormsecurity.org/0907-exploits/htmldoc-overflow.txt
15
 
 mdeslaur> other PoC: http://milw0rm.com/exploits/9190
16
 
 mdeslaur> stack smashing is detected by hardy+, so setting priority to low
17
 
Bugs:
18
 
 http://www.htmldoc.org/str.php?L214
19
 
 https://bugs.gentoo.org/show_bug.cgi?id=278186
20
 
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=537637
21
 
Priority: low
22
 
Discovered-by:
23
 
Assigned-to: 
24
 
 
25
 
Patches_htmldoc:
26
 
 vendor: https://bugs.gentoo.org/attachment.cgi?id=199846
27
 
 vendor: http://cvs.fedoraproject.org/viewvc/devel/htmldoc/htmldoc-1.8.27-scanf-overflows.patch?revision=1.1&view=markup
28
 
upstream_htmldoc: needs-triage
29
 
dapper_htmldoc: ignored (reached end-of-life)
30
 
hardy_htmldoc: ignored (reached end-of-life)
31
 
intrepid_htmldoc: needed (reached end-of-life)
32
 
jaunty_htmldoc: ignored (reached end-of-life)
33
 
karmic_htmldoc: ignored (reached end-of-life)
34
 
lucid_htmldoc: not-affected (1.8.27-4.1)
35
 
maverick_htmldoc: not-affected (1.8.27-4.1)
36
 
natty_htmldoc: not-affected (1.8.27-4.1)
37
 
devel_htmldoc: not-affected (1.8.27-4.1)