CVE-2024-46478 Memory corruption in n/a

Critical 9.8 Published 24 Oct 2024 Updated 25 Oct 2024

A buffer overflow in HTMLDOC allows attackers to execute arbitrary code or cause denial of service via crafted input.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2024-46478?

CVE-2024-46478 is a critical memory corruption vulnerability in n/a, published on 24 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

HTMLDOC v1.9.18 contains a buffer overflow in parse_pre function,ps-pdf.cxx:5681.

Weakness: CWE-120

Which versions are affected by CVE-2024-46478?

It affects 1 product.

Linux distribution packages (3)

`htmldoc` SUSE:Package Hub 15 SP5	All versions	`1.9.16-bp155.2.6.1`
`htmldoc` openSUSE:Leap 15.5	All versions	`1.9.16-bp155.2.6.1`
`htmldoc` openSUSE:Tumbleweed	All versions	`1.9.18-3.1`

Products include Htmldoc Project Htmldoc.

How do I fix CVE-2024-46478?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2024-46478 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-46478 exists.

Sources

Also known as DEBIAN-CVE-2024-46478, GHSA-p9jh-f6vr-wxj3, UBUNTU-CVE-2024-46478, openSUSE-SU-2024:0349-1, openSUSE-SU-2024:14460-1.