Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-46478: HTMLDOC Vulnerability: Buffer Overflow in HTML Parsing

CVE-2024-46478 · published 2 years ago

Summary

The HTMLDOC software has a bug that could allow an attacker to crash the application or execute malicious code if they manipulate the input HTML documents. This affects anyone using HTMLDOC to process user-supplied HTML content. Users should update to the latest version of HTMLDOC to fix this issue.

What to do

Update debian htmldoc to version 1.9.18-3.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	htmldoc_project	htmldoc	1.9.18 `cpe:2.3:a:htmldoc_project:htmldoc:1.9.18:::::::*`
Debian:12	debian	htmldoc	All versions
Debian:13	debian	htmldoc	< 1.9.18-3 Fix: upgrade to 1.9.18-3

Original advisory text

HTMLDOC v1.9.18 contains a buffer overflow in parse_pre function,ps-pdf.cxx:5681.

References

https://github.com/michaelrsweet/htmldoc/issues/529 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/46xxx/CVE-2024-46478... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-46478 Vendor Advisory
https://github.com/michaelrsweet/htmldoc/commit/683bec548e642cf4a17e003fb34f6bba... Patch
https://security-tracker.debian.org/tracker/CVE-2024-46478 Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.8 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-120Classic Buffer Overflow

Timeline

Published24 Oct 2024

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-46478 · NVD

CVE-2024-46478 · OSV

DEBIAN-CVE-2024-46478 · OSV

Track software like this

Free during beta