CVE-2009-3050

2009-09-0200:00:00

ubuntu.com

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.005 Low

EPSS

Percentile

76.3%

JSON

Buffer overflow in the set_page_size function in util.cxx in HTMLDOC 1.8.27
and earlier allows context-dependent attackers to execute arbitrary code
via a long MEDIA SIZE comment. NOTE: it was later reported that there were
additional vectors in htmllib.cxx and ps-pdf.cxx using an AFM font file
with a long glyph name, but these vectors do not cross privilege
boundaries.

Bugs

Notes

Author	Note
mdeslaur	PoC: http://packetstormsecurity.org/0907-exploits/htmldoc-overflow.txt other PoC: http://milw0rm.com/exploits/9190 stack smashing is detected by hardy+, so setting priority to low