Security Vulnerability - Action Required: NULL Pointer Dereference may in your project
Closed this issue · 6 comments
Hi,
we have detected that your project may be vulnerable to NULL Pointer Dereference in the function of file_basename in the file of htmldoc/file.c . It shares similarities to a recent CVE disclosure CVE-2021-23180 in the htmldoc.
The source vulnerability information is as follows:
Vulnerability Detail:
CVE Identifier: CVE-2021-23180
Description: A flaw was found in htmldoc in v1.9.12 and before. Null pointer dereference in file_extension(),in file.c may lead to execute arbitrary code and denial of service.
Reference: https://nvd.nist.gov/vuln/detail/CVE-2021-23180
Patch: 19c582f
Would you help to check if this bug is true? If it's true, I'd like to open a PR for that if necessary. Thank you for your effort and patience!
Looks like the same issue could happen here...
@michaelrsweet is there any need to request a CVEID because of the high priority here?
I really don’t think so. We really didn’t need one for the other bug, and it isn’t like you could do anything besides crash the program.
But crashing the program itself is a consequence, so don’t we need to inform users by applying for CVEID?
Crash != CVE