Bug 869413 (CVE-2021-40647, CVE-2021-40648) – sys-apps/man2html: multiple vulnerabilities

• Product: Gentoo Security
• Status: CONFIRMED ---

[Description John Helmert III 2022-09-10 01:58:07 UTC]

CVE-2021-40647:

In man2html 1.6g, a specific string being read in from a file will overwrite the size parameter in the top chunk of the heap. This at least causes the program to segmentation abort if the heap size parameter isn't aligned correctly. In version before GLIBC version 2.29 and aligned correctly, it allows arbitrary write anywhere in the programs memory.

CVE-2021-40648

In man2html 1.6g, a filename can be created to overwrite the previous size parameter of the next chunk and the fd, bk, fd_nextsize, bk_nextsize of the current chunk. The next chunk is then freed later on, causing a freeing of an arbitrary amount of memory.

There's a very helpful reference to "http://man2html.com" which isn't
even a registered domain, as far as I can tell, and another to
"http://na.com", which seems irrelevant at best. So we're left only
with URL to go on.

There seems to somehow be two different man2html's. The one that we
have is written mostly in C, whose homepage is dead [1], and whose
last release happened in 2010. Maintained by Andries Brouwer until
200502 when Federico Lucifredi took over.

The other is written in perl [2]. It became a Savannah project in
200305, after having been maintained by Earl Hood since at least 1997.

[1] https://web.archive.org/web/20131205162156/primates.ximian.com/~flucifredi/man/
[2] https://www.nongnu.org/man2html/

I *suppose* these two packages fulfill a very similar purpose, so
maybe we should switch upstreams?

[Comment 1 Hans de Graaff 2023-10-20 11:35:28 UTC]

My vote would be to mask this package for removal. The perl version also does not seem to be maintained, and the only optional reverse dependency is sys-cluster/slurm which uses it to create HTML pages from the man pages. In fact, sys-cluster/slurm is package masked itself due to security bugs.

Adding the slurm maintainer as well to see if we can come to a quick resolution here.