CVE-2021-23180

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A flaw was found in htmldoc in v1.9.12 and before. Null pointer dereference in file_extension(),in file.c may lead to execute arbitrary code and denial of service.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	htmldoc	Fixed in htmldoc v1.9.12 and above.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1967041Issue Tracking, Patch, Third Party Advisory
https://github.com/michaelrsweet/htmldoc/commit/19c582fb32eac74b57e155cffbb529377a9e751aPatch, Third Party Advisory
https://github.com/michaelrsweet/htmldoc/issues/418Exploit, Issue Tracking, Third Party Advisory
https://ubuntu.com/security/CVE-2021-23180Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1967041Issue Tracking, Patch, Third Party Advisory
https://github.com/michaelrsweet/htmldoc/commit/19c582fb32eac74b57e155cffbb529377a9e751aPatch, Third Party Advisory
https://github.com/michaelrsweet/htmldoc/issues/418Exploit, Issue Tracking, Third Party Advisory
https://ubuntu.com/security/CVE-2021-23180Third Party Advisory

Timeline

Published: Mar 2, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-231824.4Cleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre Server allows OSDP reader master keys to be d CVE-2021-231868.7A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to access and CVE-2021-231883.3Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow an authenticated user to potentially e CVE-2021-23199.1Vulnerability in the Oracle Cloud Infrastructure Storage Gateway product of Oracle Storage Gateway (component: Management Console). The supp CVE-2021-231917.8A security issue was found in htmldoc v1.9.12 and before. A NULL pointer dereference in the function image_load_jpeg() in image.cxx may resu CVE-2021-231927.5A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request, and chose to fragmen CVE-2021-231936.5Improper privilege validation vulnerability in COM Interface of Gallagher Command Centre Server allows authenticated unprivileged operators CVE-2021-231955.3Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 has the option for automated indexing (directory listing) activ CVE-2021-231969.8The web application on Agilia Link+ version 3.0 implements authentication and session management mechanisms exclusively on the client-side a CVE-2021-231977.8Unquoted service path vulnerability in the Gallagher Controller Service allows an unprivileged user to execute arbitrary code as the account CVE-2021-231989.8mySCADA myPRO: Versions 8.20.0 and prior has a feature where the password can be specified, which may allow an attacker to inject arbitrary CVE-2021-23209.1Vulnerability in the Oracle Cloud Infrastructure Storage Gateway product of Oracle Storage Gateway (component: Management Console). The supp