Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 869413 (CVE-2021-40647, CVE-2021-40648) - sys-apps/man2html: multiple vulnerabilities
Summary: sys-apps/man2html: multiple vulnerabilities
Alias: CVE-2021-40647, CVE-2021-40648
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
Whiteboard: B2 [??]
Depends on:
Reported: 2022-09-10 01:58 UTC by John Helmert III
Modified: 2023-10-20 11:35 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-09-10 01:58:07 UTC

In man2html 1.6g, a specific string being read in from a file will overwrite the size parameter in the top chunk of the heap. This at least causes the program to segmentation abort if the heap size parameter isn't aligned correctly. In version before GLIBC version 2.29 and aligned correctly, it allows arbitrary write anywhere in the programs memory.


In man2html 1.6g, a filename can be created to overwrite the previous size parameter of the next chunk and the fd, bk, fd_nextsize, bk_nextsize of the current chunk. The next chunk is then freed later on, causing a freeing of an arbitrary amount of memory.

There's a very helpful reference to "" which isn't
even a registered domain, as far as I can tell, and another to
"", which seems irrelevant at best. So we're left only
with URL to go on.

There seems to somehow be two different man2html's. The one that we
have is written mostly in C, whose homepage is dead [1], and whose
last release happened in 2010. Maintained by Andries Brouwer until
200502 when Federico Lucifredi took over.

The other is written in perl [2]. It became a Savannah project in
200305, after having been maintained by Earl Hood since at least 1997.


I *suppose* these two packages fulfill a very similar purpose, so
maybe we should switch upstreams?
Comment 1 Hans de Graaff gentoo-dev Security 2023-10-20 11:35:28 UTC
My vote would be to mask this package for removal. The perl version also does not seem to be maintained, and the only optional reverse dependency is sys-cluster/slurm which uses it to create HTML pages from the man pages. In fact, sys-cluster/slurm is package masked itself due to security bugs.

Adding the slurm maintainer as well to see if we can come to a quick resolution here.