CVE-2009-3050

Buffer overflow in the set_page_size function in util.cxx in HTMLDOC 1.8.27 and earlier allows context-dependent attackers to execute…

High10.0EPSS 4.4%

Published: 2 Sept 2009
Updated: 17 Sept 2024
Reserved: 2 Sept 2009
Assigned by: mitre

Description

Buffer overflow in the set_page_size function in util.cxx in HTMLDOC 1.8.27 and earlier allows context-dependent attackers to execute arbitrary code via a long MEDIA SIZE comment. NOTE: it was later reported that there were additional vectors in htmllib.cxx and ps-pdf.cxx using an AFM font file with a long glyph name, but these vectors do not cross privilege boundaries.

Scores

CVSS scores of CVE-2009-3050, by who scored it
Scored by	CVSS	Score	Vector
NVDNVD · Modified	2.0	High10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS (exploitation in 30 days): 4.4% · top 8.7% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 10.0.

Weakness

Affected products

n/a
- affected n/a

References (7)

http://packetstormsecurity.org/0907-exploits/htmldoc-overflow.txt (opens in a new tab)x_refsource_MISCx_transferred
[oss-security] 20090901 Re: CVE Request -- HTMLDOC (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
35780 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
http://www.htmldoc.org/str.php?L214 (opens in a new tab)x_refsource_CONFIRMx_transferred
http://bugs.gentoo.org/show_bug.cgi?id=278186 (opens in a new tab)x_refsource_CONFIRMx_transferred
[oss-security] 20090725 Re: CVE Request -- HTMLDOC (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
[oss-security] 20090726 Re: CVE Request -- HTMLDOC (opens in a new tab)mailing-listx_refsource_MLISTx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2009-3050](https://trackcve.app/badge/CVE-2009-3050.svg)](https://trackcve.app/cve/CVE-2009-3050)

Record last updated 17 Sept 2024, 01:17 UTC.