[Epel-packagers-sig] [Bug 2126075] New: CVE-2021-40648 sys-apps/man2html: multiple vulnerabilities

https://bugzilla.redhat.com/show_bug.cgi?id=2126075

Bug ID: 2126075
           Summary: CVE-2021-40648 sys-apps/man2html: multiple
                    vulnerabilities
           Product: Security Response
          Hardware: All
                OS: Linux
            Status: NEW
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: [e-mail]
          Reporter: [e-mail]
                CC: [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail]
  Target Milestone: ---
    Classification: Other

CVE-2021-40648:

In man2html 1.6g, a filename can be created to overwrite the previous size
parameter of the next chunk and the fd, bk, fd_nextsize, bk_nextsize of the
current chunk. The next chunk is then freed later on, causing a freeing of an
arbitrary amount of memory.

https://gist.github.com/untaman/cb58123fe89fc65e3984165db5d40933