CVE-2021-23206

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A flaw was found in htmldoc in v1.9.12 and prior. A stack buffer overflow in parse_table() in ps-pdf.cxx may lead to execute arbitrary code and denial of service.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121 CWE-787

Affected software

Vendor	Product	Versions
n/a	htmldoc	Affects v1.9.12 and prior, Fixed in v1.9.12+

References

https://bugzilla.redhat.com/show_bug.cgi?id=1967028Issue Tracking, Patch, Third Party Advisory
https://github.com/michaelrsweet/htmldoc/commit/ba61a3ece382389ae4482c7027af8b32e8ab4cc8Patch, Third Party Advisory
https://github.com/michaelrsweet/htmldoc/issues/416Exploit, Issue Tracking, Third Party Advisory
https://ubuntu.com/security/CVE-2021-23206Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1967028Issue Tracking, Patch, Third Party Advisory
https://github.com/michaelrsweet/htmldoc/commit/ba61a3ece382389ae4482c7027af8b32e8ab4cc8Patch, Third Party Advisory
https://github.com/michaelrsweet/htmldoc/issues/416Exploit, Issue Tracking, Third Party Advisory
https://ubuntu.com/security/CVE-2021-23206Third Party Advisory

Timeline

Published: Mar 2, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-232075.5An attacker with physical access to the host can extract the secrets from the registry and create valid JWT tokens for the Fresenius Kabi Vi CVE-2021-232094.8Multiple Authenticated (admin user role) Persistent Cross-Site Scripting (XSS) vulnerabilities discovered in AMP for WP – Accelerated Mobile CVE-2021-23216.0Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prio CVE-2021-232105.5A floating point exception (divide-by-zero) issue was discovered in SoX in functon read_samples() of voc.c file. An attacker with a crafted CVE-2021-232114.4Cleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre Server allows Cloud end-to-end encryption key CVE-2021-232148.1When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle a CVE-2021-232155.5An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could CVE-2021-232177.5NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller, which may allow a user with elevated privileges to in CVE-2021-232187.5When running with FIPS mode enabled, Mirantis Container Runtime 20.10.8 leaks memory during TLS Handshakes which could be abused to cause a CVE-2021-232194.1NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller, which may allow a user with elevated privileges to ac CVE-2021-23228.8Vulnerability in OpenGrok (component: Web App). Versions that are affected are 1.6.7 and prior. Easily exploitable vulnerability allows low CVE-2021-232225.9A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification a