Lucene search

DebianDEBIAN:DSA-4006-1:C4D54

HistoryOct 24, 2017 - 3:41 p.m.

[SECURITY] [DSA 4006-1] mupdf security update

2017-10-2415:41:10

lists.debian.org

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.8%

JSON

Debian Security Advisory DSA-4006-1 [email protected]
https://www.debian.org/security/
October 24, 2017 https://www.debian.org/security/faq

Package : mupdf
CVE ID : CVE-2017-14685 CVE-2017-14686 CVE-2017-14687 CVE-2017-15587
Debian Bug : 877379 879055

Multiple vulnerabilities have been found in MuPDF, a PDF file viewer, which
may result in denial of service or the execution of arbitrary code.

CVE-2017-14685, CVE-2017-14686, and CVE-2017-14687

 WangLin discovered that a crafted .xps file can crash MuPDF and
 potentially execute arbitrary code in several ways, since the
 application makes unchecked assumptions on the entry format.

CVE-2017-15587

Terry Chia and Jeremy Heng discovered an integer overflow that can
cause arbitrary code execution via a crafted .pdf file.

For the stable distribution (stretch), these problems have been fixed in
version 1.9a+ds1-4+deb9u1.

We recommend that you upgrade your mupdf packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian9mips64elmupdf-dbgsym< 1.9a+ds1-4+deb9u1mupdf-dbgsym_1.9a+ds1-4+deb9u1_mips64el.deb
Debian8arm64mupdf< 1.5-1+deb8u3mupdf_1.5-1+deb8u3_arm64.deb
Debian9amd64libmupdf-dev< 1.9a+ds1-4+deb9u2libmupdf-dev_1.9a+ds1-4+deb9u2_amd64.deb
Debian7armellibmupdf-dev< 0.9-2+deb7u4libmupdf-dev_0.9-2+deb7u4_armel.deb
Debian8armelmupdf< 1.5-1+deb8u3mupdf_1.5-1+deb8u3_armel.deb
Debian9armhfmupdf-dbgsym< 1.9a+ds1-4+deb9u2mupdf-dbgsym_1.9a+ds1-4+deb9u2_armhf.deb
Debian7i386mupdf< 0.9-2+deb7u4mupdf_0.9-2+deb7u4_i386.deb
Debian8amd64mupdf-tools< 1.5-1+deb8u3mupdf-tools_1.5-1+deb8u3_amd64.deb
Debian9armhfmupdf-tools< 1.9a+ds1-4+deb9u1mupdf-tools_1.9a+ds1-4+deb9u1_armhf.deb
Debian9i386mupdf-dbgsym< 1.9a+ds1-4+deb9u2mupdf-dbgsym_1.9a+ds1-4+deb9u2_i386.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	mips64el	mupdf-dbgsym	< 1.9a+ds1-4+deb9u1	mupdf-dbgsym_1.9a+ds1-4+deb9u1_mips64el.deb
Debian	8	arm64	mupdf	< 1.5-1+deb8u3	mupdf_1.5-1+deb8u3_arm64.deb
Debian	9	amd64	libmupdf-dev	< 1.9a+ds1-4+deb9u2	libmupdf-dev_1.9a+ds1-4+deb9u2_amd64.deb
Debian	7	armel	libmupdf-dev	< 0.9-2+deb7u4	libmupdf-dev_0.9-2+deb7u4_armel.deb
Debian	8	armel	mupdf	< 1.5-1+deb8u3	mupdf_1.5-1+deb8u3_armel.deb
Debian	9	armhf	mupdf-dbgsym	< 1.9a+ds1-4+deb9u2	mupdf-dbgsym_1.9a+ds1-4+deb9u2_armhf.deb
Debian	7	i386	mupdf	< 0.9-2+deb7u4	mupdf_0.9-2+deb7u4_i386.deb
Debian	8	amd64	mupdf-tools	< 1.5-1+deb8u3	mupdf-tools_1.5-1+deb8u3_amd64.deb
Debian	9	armhf	mupdf-tools	< 1.9a+ds1-4+deb9u1	mupdf-tools_1.9a+ds1-4+deb9u1_armhf.deb
Debian	9	i386	mupdf-dbgsym	< 1.9a+ds1-4+deb9u2	mupdf-dbgsym_1.9a+ds1-4+deb9u2_i386.deb