« Volver al listado

CVE-2009-3050

Estado: ModificadaAlta (10)—

Buffer overflow in the set_page_size function in util.cxx in HTMLDOC 1.8.27 and earlier allows context-dependent attackers to execute arbitrary code via a long MEDIA SIZE comment. NOTE: it was later reported that there were additional vectors in htmllib.cxx and ps-pdf.cxx using an AFM font file with a long glyph name, but these vectors do not cross privilege boundaries.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Htmldoc — Htmldoc

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-3050",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-09-02T17:30:01.313",
  "references": [
    {
      "url": "http://bugs.gentoo.org/show_bug.cgi?id=278186",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.org/0907-exploits/htmldoc-overflow.txt",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/35780",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.htmldoc.org/str.php?L214",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2009/07/25/3",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2009/07/26/2",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2009/09/01/1",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://bugs.gentoo.org/show_bug.cgi?id=278186",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://packetstormsecurity.org/0907-exploits/htmldoc-overflow.txt",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/35780",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.htmldoc.org/str.php?L214",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2009/07/25/3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2009/07/26/2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2009/09/01/1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Buffer overflow in the set_page_size function in util.cxx in HTMLDOC 1.8.27 and earlier allows context-dependent attackers to execute arbitrary code via a long MEDIA SIZE comment.  NOTE: it was later reported that there were additional vectors in htmllib.cxx and ps-pdf.cxx using an AFM font file with a long glyph name, but these vectors do not cross privilege boundaries."
    },
    {
      "lang": "es",
      "value": "Desbordamiento de búfer en la función set_page_size en util.cxx en HTMLDOC 1.8.27 y versiones anteriores permite a atacantes dependientes de contexto ejecutar código de su elección mediante un comentario MEDIA SIZE largo. NOTA: más tarde se informó que había vectores adicionales en htmllib.cxx y ps-pdf.cxx utilizando un archivo de fuentes AFM con un nombre glyph largo, pero estos vectores no traspasan la frontera de privilegios."
    }
  ],
  "lastModified": "2026-06-16T23:10:48.177",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:htmldoc:htmldoc:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "869A7EC3-6B3E-45B8-A507-CE0004CC12E0",
              "versionEndIncluding": "1.8.27"
            },
            {
              "criteria": "cpe:2.3:a:htmldoc:htmldoc:1.8.24:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC979928-F1B0-43C6-97A2-066BC6DC5B7A"
            },
            {
              "criteria": "cpe:2.3:a:htmldoc:htmldoc:1.8.25:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8ACF69DD-2922-4B08-A13C-8F5AB50E2FB8"
            },
            {
              "criteria": "cpe:2.3:a:htmldoc:htmldoc:1.8.26:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE1F2321-B852-4660-BAF2-A19B3A501897"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}