Mageia alert MGASA-2025-0097 (man2html)

From:
             
 
Mageia Updates <updates-announce@ml.mageia.org>
To:
             
 
updates-announce@ml.mageia.org
Subject:
             
 
[updates-announce] MGASA-2025-0097: Updated man2html man2html packages fix security vulnerability
Date:
             
 
Sat, 15 Mar 2025 02:41:15 +0100
Message-ID:
             
 
<20250315014115.BF438A017D@duvel.mageia.org>
Archive-link:
             
 
Article
MGASA-2025-0097 - Updated man2html man2html packages fix security vulnerability

Publication date: 15 Mar 2025
URL: https://advisories.mageia.org/MGASA-2025-0097.html
Type: security
Affected Mageia releases: 9
CVE: CVE-2021-40647

Description:
In man2html 1.6g, a specific string being read in from a file will
overwrite the size parameter in the top chunk of the heap. This at least
causes the program to segmentation abort if the heap size parameter
isn't aligned correctly. In versions before GLIBC version 2.29 and
if aligned correctly, it allows arbitrary writes anywhere in the program's
memory.

References:
- https://bugs.mageia.org/show_bug.cgi?id=34072
-
https://lists.fedoraproject.org/archives/list/package-ann...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4...

SRPMS:
- 9/core/man2html-1.6-6.1.mga9