[SECURITY] [DLA 1164-1] mupdf security update

2017-11-0713:17:36

lists.debian.org

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.8%

JSON

Package : mupdf
Version : 0.9-2+deb7u4
CVE ID : CVE-2017-14687 CVE-2017-15587
Debian Bug : 877379 879055

Two security issues were discovered in mupdf, a lightweight PDF viewer.

CVE-2017-14687
MuPDF allows attackers to cause a denial of service or possibly have
unspecified other impact via a crafted .xps file. This occurs
because of mishandling of XML tag name comparisons.

CVE-2017-15587
An integer overflow was discovered in pdf_read_new_xref_section in
pdf/pdf-xref.c

For Debian 7 "Wheezy", these problems have been fixed in version
0.9-2+deb7u4.

We recommend that you upgrade your mupdf packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian9mipselmupdf< 1.9a+ds1-4+deb9u2mupdf_1.9a+ds1-4+deb9u2_mipsel.deb
Debian9amd64mupdf-dbgsym< 1.9a+ds1-4+deb9u2mupdf-dbgsym_1.9a+ds1-4+deb9u2_amd64.deb
Debian9i386mupdf-tools-dbgsym< 1.9a+ds1-4+deb9u2mupdf-tools-dbgsym_1.9a+ds1-4+deb9u2_i386.deb
Debian9armelmupdf< 1.9a+ds1-4+deb9u2mupdf_1.9a+ds1-4+deb9u2_armel.deb
Debian9i386mupdf< 1.9a+ds1-4+deb9u2mupdf_1.9a+ds1-4+deb9u2_i386.deb
Debian9amd64libmupdf-dev< 1.9a+ds1-4+deb9u2libmupdf-dev_1.9a+ds1-4+deb9u2_amd64.deb
Debian9armhfmupdf-dbgsym< 1.9a+ds1-4+deb9u2mupdf-dbgsym_1.9a+ds1-4+deb9u2_armhf.deb
Debian9s390xmupdf-tools-dbgsym< 1.9a+ds1-4+deb9u2mupdf-tools-dbgsym_1.9a+ds1-4+deb9u2_s390x.deb
Debian8mipselmupdf< 1.5-1+deb8u3mupdf_1.5-1+deb8u3_mipsel.deb
Debian9mipsmupdf< 1.9a+ds1-4+deb9u2mupdf_1.9a+ds1-4+deb9u2_mips.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	mipsel	mupdf	< 1.9a+ds1-4+deb9u2	mupdf_1.9a+ds1-4+deb9u2_mipsel.deb
Debian	9	amd64	mupdf-dbgsym	< 1.9a+ds1-4+deb9u2	mupdf-dbgsym_1.9a+ds1-4+deb9u2_amd64.deb
Debian	9	i386	mupdf-tools-dbgsym	< 1.9a+ds1-4+deb9u2	mupdf-tools-dbgsym_1.9a+ds1-4+deb9u2_i386.deb
Debian	9	armel	mupdf	< 1.9a+ds1-4+deb9u2	mupdf_1.9a+ds1-4+deb9u2_armel.deb
Debian	9	i386	mupdf	< 1.9a+ds1-4+deb9u2	mupdf_1.9a+ds1-4+deb9u2_i386.deb
Debian	9	amd64	libmupdf-dev	< 1.9a+ds1-4+deb9u2	libmupdf-dev_1.9a+ds1-4+deb9u2_amd64.deb
Debian	9	armhf	mupdf-dbgsym	< 1.9a+ds1-4+deb9u2	mupdf-dbgsym_1.9a+ds1-4+deb9u2_armhf.deb
Debian	9	s390x	mupdf-tools-dbgsym	< 1.9a+ds1-4+deb9u2	mupdf-tools-dbgsym_1.9a+ds1-4+deb9u2_s390x.deb
Debian	8	mipsel	mupdf	< 1.5-1+deb8u3	mupdf_1.5-1+deb8u3_mipsel.deb
Debian	9	mips	mupdf	< 1.9a+ds1-4+deb9u2	mupdf_1.9a+ds1-4+deb9u2_mips.deb