CVE-2024-45508
Critical · 9.8CVSS
9.8
EPSS
0.7%
Published
Sep 1, 2024
CISA due date
—
Cloudanix analysis
A flaw in document conversion software can let attackers crash the program or run their own code when users process certain files.
- Exploitation
- Requires User Interaction
- Attacker needs
- User Interaction
- Complexity
- Low
- Impact
- Remote Code Execution
- Component
- Application
- Class
- Buffer Overflow
- Remediation
- Upgrade
- Effort
- Low
- Patch risk
- Low
What it actually does
Out-of-bounds write in parse_paragraph in ps-pdf.cxx triggered when stripping leading whitespace from a whitespace-only node during HTML/PDF conversion.
Why it matters to the business
Processing untrusted documents on affected systems can cause crashes or arbitrary code execution, disrupting document workflows and exposing infrastructure to remote compromise.
How an attack unfolds
An attacker supplies a specially crafted HTML document containing a whitespace-only node; when HTMLDOC or poppler parses the paragraph the flawed whitespace stripping logic writes beyond buffer bounds, allowing memory corruption that may be turned into code execution.
How to fix it
Upgrade HTMLDOC to 1.9.19 or later; for poppler on Debian 11/12/13 upgrade to 0.85.0-2 or newer; for Ubuntu 20.04 LTS upgrade to 0.86.1-0ubuntu1 or newer; for michaelrsweet/htmldoc apply commit 2d5b2ab9ddbf2aee2209010cebc11efdd1cab6e2.
How to confirm the fix worked
Confirm installed package version matches or exceeds the listed fixed releases; re-test parsing of whitespace-only paragraph test cases to verify absence of the write.
Typical attack path
- Craft malicious HTML with whitespace-only paragraph node
- Deliver document to target via email, web upload, or file share
- Victim application invokes parse_paragraph during conversion
- Out-of-bounds write corrupts adjacent memory
- Attacker leverages corruption for control-flow hijack or denial of service
How to detect it
Review application logs for crashes or segmentation faults during HTML/PDF conversion; inspect process memory dumps for patterns consistent with out-of-bounds writes in ps-pdf.cxx parsing routines.
What your security team should do
- Immediately upgrade all instances of HTMLDOC and poppler to the fixed versions listed
- Scan repositories and build pipelines for affected package versions
- Add the vulnerability to vulnerability management dashboards with high priority
- Monitor for any new public exploits given the high CVSS score
The record
HTMLDOC before 1.9.19 has an out-of-bounds write in parse_paragraph in ps-pdf.cxx because of an attempt to strip leading whitespace from a whitespace-only node.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | htmldoc | 0 | No fix |
| Debian:12 | htmldoc | 0 | No fix |
| Debian:13 | htmldoc | 0 | 1.9.18-2 |
| Debian:14 | htmldoc | 0 | 1.9.18-2 |
| Mageia:9 | htmldoc | 0 | 1.9.15-3.1.mga9 |
| SUSE:Package Hub 15 SP5 | htmldoc | 0 | 1.9.16-bp155.2.3.1 |
| SUSE:Package Hub 15 SP6 | htmldoc | 0 | 1.9.16-bp156.3.3.1 |
| Ubuntu:20.04:LTS | htmldoc | 0 | No fix |
| Ubuntu:22.04:LTS | htmldoc | 0 | No fix |
| Ubuntu:24.04:LTS | htmldoc | 0 | No fix |
| Ubuntu:24.10 | htmldoc | 0 | No fix |
| Ubuntu:24.10 | htmldoc | 0 | 1.9.18-1ubuntu0.1 |
| Ubuntu:Pro:14.04:LTS | htmldoc | 0 | No fix |
| Ubuntu:Pro:14.04:LTS | htmldoc | 0 | 1.8.27-8ubuntu1+esm4 |
| Ubuntu:Pro:16.04:LTS | htmldoc | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | htmldoc | 0 | 1.8.27-8ubuntu1.1+esm3 |
| Ubuntu:Pro:18.04:LTS | htmldoc | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | htmldoc | 0 | 1.9.2-1ubuntu0.2+esm2 |
| Ubuntu:Pro:20.04:LTS | htmldoc | 0 | 1.9.7-1ubuntu0.3+esm2 |
| Ubuntu:Pro:22.04:LTS | htmldoc | 0 | 1.9.15-1ubuntu0.1~esm1 |
| Ubuntu:Pro:24.04:LTS | htmldoc | 0 | 1.9.17-1ubuntu0.1~esm1 |
| openSUSE:Leap 15.5 | htmldoc | 0 | 1.9.16-bp155.2.3.1 |
| openSUSE:Leap 15.6 | htmldoc | 0 | 1.9.16-bp156.3.3.1 |
| openSUSE:Leap 16.0 | htmldoc | 0 | 1.9.23-bp160.1.1 |
| openSUSE:Tumbleweed | htmldoc | 0 | 1.9.18-2.1 |