{"id":"CVE-2021-23191","details":"A security issue was found in htmldoc v1.9.12 and before. A NULL pointer dereference in the function image_load_jpeg() in image.cxx may result in denial of service.","modified":"2026-07-08T21:26:01.268865Z","published":"2022-03-02T23:15:08.347Z","references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/CVE-2021-23191"},{"type":"REPORT","url":"https://github.com/michaelrsweet/htmldoc/issues/415"},{"type":"FIX","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1967022"},{"type":"FIX","url":"https://github.com/michaelrsweet/htmldoc/commit/369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/michaelrsweet/htmldoc","events":[{"introduced":"0"},{"last_affected":"df5d3010151a506c5ca138548aac02b37fb421f9"},{"fixed":"369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc"}],"database_specific":{"cpe":"cpe:2.3:a:htmldoc_project:htmldoc:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"1.9.12"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v1.9.12","v1.9.11","v1.9.10","v1.9.9","v1.9.8","v1.9.7","v1.9.6","v1.9.5","v1.9.4","v1.9.3","v1.9.2","v1.9.1","v1.9","v1.8.30"],"database_specific":{"vanir_signatures":[{"digest":{"function_hash":"92322127114415870521607068119991088032","length":2039},"id":"CVE-2021-23191-1f68d2fe","signature_type":"Function","signature_version":"v1","source":"https://github.com/michaelrsweet/htmldoc/commit/369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc","target":{"function":"pspdf_prepare_page","file":"htmldoc/ps-pdf.cxx"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/michaelrsweet/htmldoc/commit/369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc","target":{"file":"htmldoc/ps-pdf.cxx","function":"write_trailer"},"deprecated":false,"digest":{"function_hash":"319000601398196051361739018736045259971","length":5590},"id":"CVE-2021-23191-335d3575","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"273838597093441093367409498317500445991","length":1495},"id":"CVE-2021-23191-3a6adf34","signature_type":"Function","signature_version":"v1","source":"https://github.com/michaelrsweet/htmldoc/commit/369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc","target":{"file":"htmldoc/image.cxx","function":"image_load_jpeg"}},{"digest":{"line_hashes":["24233290535264989810748690679705506210","100801203083552384439762334466782870457","286453315102484514880779508538999003133","325380916168297110754537502992714039597","142913364914498751147094645847081107842","2327086209042552317056688615316982611"],"threshold":0.9},"id":"CVE-2021-23191-637cccf5","signature_type":"Line","signature_version":"v1","source":"https://github.com/michaelrsweet/htmldoc/commit/369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc","target":{"file":"htmldoc/file.c"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/michaelrsweet/htmldoc/commit/369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc","target":{"function":"file_rlookup","file":"htmldoc/file.c"},"deprecated":false,"digest":{"function_hash":"253040243785350020620576354982529485400","length":231},"id":"CVE-2021-23191-7b516114","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["174351675257079302674288344624817020623","101601067056068637150692630605931669980","280391808546796513492317466962874985719","284919528584911699891782557142563906198","316655231958914577262750320733714241484","259903975631848402735195579438303810430","252468788629462972060277174261718033030","132214329166457028830166077776864133259"],"threshold":0.9},"id":"CVE-2021-23191-a05e793f","signature_type":"Line","signature_version":"v1","source":"https://github.com/michaelrsweet/htmldoc/commit/369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc","target":{"file":"htmldoc/ps-pdf.cxx"}},{"deprecated":false,"digest":{"line_hashes":["93662261141235397336793541586627527916","178372303592823082188525915246518540","182627793998545929107488062471140628976","49165471055202665109567153679255754669","212925988256507582288616706848766924941","319138341660598085657295740529178907075","216016017510746556388864693638497132619","248935907130947220320096162946614045664","150202415247926317426841370161245844037","37660859905881833385899212080022329555","108056819864349876478404953972008958215","231504663485709970494918551729485520299","124873979014350377780002559371087860547","324261901752826121729680621978216219693","204453826772054237783218990803904725774","88619547742534205724900377237136528247","216161839705182387489013709942683485324"],"threshold":0.9},"id":"CVE-2021-23191-a3c2eb74","signature_type":"Line","signature_version":"v1","source":"https://github.com/michaelrsweet/htmldoc/commit/369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc","target":{"file":"htmldoc/image.cxx"}},{"digest":{"function_hash":"257817902150553678093130567542449157059","length":44},"id":"CVE-2021-23191-c6a9284b","signature_type":"Function","signature_version":"v1","source":"https://github.com/michaelrsweet/htmldoc/commit/369b2ea1fd0d0537ba707f20a2f047b6afd2fbdc","target":{"file":"htmldoc/image.cxx","function":"jpeg_error_handler"},"deprecated":false}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-23191.json","vanir_signatures_modified":"2026-07-08T21:26:01Z"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}