{"id":"CVE-2021-23158","details":"A flaw was found in htmldoc in v1.9.12. Double-free in function pspdf_export(),in ps-pdf.cxx may result in a write-what-where condition, allowing an attacker to execute arbitrary code and denial of service.","modified":"2026-07-08T21:26:00.074328Z","published":"2022-03-16T15:15:10.100Z","references":[{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1967018"},{"type":"REPORT","url":"https://github.com/michaelrsweet/htmldoc/issues/414"},{"type":"FIX","url":"https://github.com/michaelrsweet/htmldoc/commit/369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/michaelrsweet/htmldoc","events":[{"introduced":"df5d3010151a506c5ca138548aac02b37fb421f9"},{"last_affected":"df5d3010151a506c5ca138548aac02b37fb421f9"},{"fixed":"369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc"}],"database_specific":{"cpe":"cpe:2.3:a:htmldoc_project:htmldoc:1.9.12:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.9.12"},{"last_affected":"1.9.12"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["1.9.12","v1.9.12"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-23158.json","vanir_signatures_modified":"2026-07-08T21:26:00Z","vanir_signatures":[{"digest":{"function_hash":"92322127114415870521607068119991088032","length":2039},"id":"CVE-2021-23158-1f68d2fe","signature_type":"Function","signature_version":"v1","source":"https://github.com/michaelrsweet/htmldoc/commit/369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc","target":{"file":"htmldoc/ps-pdf.cxx","function":"pspdf_prepare_page"},"deprecated":false},{"target":{"file":"htmldoc/ps-pdf.cxx","function":"write_trailer"},"deprecated":false,"digest":{"length":5590,"function_hash":"319000601398196051361739018736045259971"},"id":"CVE-2021-23158-335d3575","signature_type":"Function","signature_version":"v1","source":"https://github.com/michaelrsweet/htmldoc/commit/369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc"},{"deprecated":false,"digest":{"function_hash":"273838597093441093367409498317500445991","length":1495},"id":"CVE-2021-23158-3a6adf34","signature_type":"Function","signature_version":"v1","source":"https://github.com/michaelrsweet/htmldoc/commit/369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc","target":{"file":"htmldoc/image.cxx","function":"image_load_jpeg"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/michaelrsweet/htmldoc/commit/369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc","target":{"file":"htmldoc/file.c"},"deprecated":false,"digest":{"line_hashes":["24233290535264989810748690679705506210","100801203083552384439762334466782870457","286453315102484514880779508538999003133","325380916168297110754537502992714039597","142913364914498751147094645847081107842","2327086209042552317056688615316982611"],"threshold":0.9},"id":"CVE-2021-23158-637cccf5"},{"digest":{"function_hash":"253040243785350020620576354982529485400","length":231},"id":"CVE-2021-23158-7b516114","signature_type":"Function","signature_version":"v1","source":"https://github.com/michaelrsweet/htmldoc/commit/369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc","target":{"file":"htmldoc/file.c","function":"file_rlookup"},"deprecated":false},{"digest":{"line_hashes":["174351675257079302674288344624817020623","101601067056068637150692630605931669980","280391808546796513492317466962874985719","284919528584911699891782557142563906198","316655231958914577262750320733714241484","259903975631848402735195579438303810430","252468788629462972060277174261718033030","132214329166457028830166077776864133259"],"threshold":0.9},"id":"CVE-2021-23158-a05e793f","signature_type":"Line","signature_version":"v1","source":"https://github.com/michaelrsweet/htmldoc/commit/369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc","target":{"file":"htmldoc/ps-pdf.cxx"},"deprecated":false},{"source":"https://github.com/michaelrsweet/htmldoc/commit/369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc","target":{"file":"htmldoc/image.cxx"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["93662261141235397336793541586627527916","178372303592823082188525915246518540","182627793998545929107488062471140628976","49165471055202665109567153679255754669","212925988256507582288616706848766924941","319138341660598085657295740529178907075","216016017510746556388864693638497132619","248935907130947220320096162946614045664","150202415247926317426841370161245844037","37660859905881833385899212080022329555","108056819864349876478404953972008958215","231504663485709970494918551729485520299","124873979014350377780002559371087860547","324261901752826121729680621978216219693","204453826772054237783218990803904725774","88619547742534205724900377237136528247","216161839705182387489013709942683485324"]},"id":"CVE-2021-23158-a3c2eb74","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/michaelrsweet/htmldoc/commit/369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc","target":{"file":"htmldoc/image.cxx","function":"jpeg_error_handler"},"deprecated":false,"digest":{"length":44,"function_hash":"257817902150553678093130567542449157059"},"id":"CVE-2021-23158-c6a9284b","signature_type":"Function"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}