CVE-2017-14686: Improper Restriction of Operations within the Bounds of a Memory Buffer

Artifex MuPDF 1.11 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to a "User Mode Write AV near NULL starting at wow64!Wow64NotifyDebugger+0x000000000000001d" on Windows. This occurs because readzipdirimp in fitz/unzip.c does not check...

CVE-2017-14685: Improper Restriction of Operations within the Bounds of a Memory Buffer

Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to "Data from Faulting Address controls Branch Selection starting at mupdf+0x000000000016aa61" on Windows. This occurs because xpsloadlinksinglyphs in...

PT-2017-13623

Name of the Vulnerable Software and Affected Versions Artifex MuPDF version 1.11 Description The issue allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file. This is related to a "User Mode Write AV near NULL" error on Windows, specifically at...

PT-2017-13622

Name of the Vulnerable Software and Affected Versions Artifex MuPDF version 1.11 Description The issue allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. This occurs because the xps load links in glyphs function in xps/xps-link.c does...

PT-2017-13624

Name of the Vulnerable Software and Affected Versions Artifex MuPDF version 1.11 Description The issue allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. This occurs because of mishandling of XML tag name comparisons, related to "Data...

MuPDF Fitz library font glyph scaling Code Execution Vulnerability(CVE-2016-8728)

Summary An exploitable heap out of bounds write vulnerability exists in the Fitz graphical library part of the MuPDF renderer. A specially crafted PDF file can cause a out of bounds write resulting in heap metadata and sensitive process memory corruption leading to potential code execution. Victi...

Artifex MuPDf JBIG2 Parser Code Execution Vulnerability(CVE-2016-8729)

Summary An exploitable memory corruption vulnerability exists in the JBIG2 parser of Artifex MuPDF 1.9. A specially crafted PDF can cause a negative number to be passed to a memset resulting in memory corruption and potential code execution. An attacker can specially craft a PDF and send to the...

Fedora 26 : mupdf (2017-487051ac16)

fix buffer overflow 1425338 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C...

Fedora 26 : mupdf (2017-d80262b43f)

Rebuild with new jbig2dec1443933 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 703...

Fedora 26 : mupdf (2017-8150618774)

Fix stack consumption CVE 1439643 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...

Out-Of-Bounds Write Vulnerability

MuPDF is vulnerable to an out-of-bounds write vulnerability. A flaw in the glyph scaling code leads to an overwrite of heap metadata and sensitive process memory when an attacker opens a malicious file in a vulnerable reader. This vulnerability also potentially results in code execution...

Artifex MuPDF - Null Pointer Dereference Vulnerability

Exploit for linux platform in category dos / poc Source: https://bugs.ghostscript.com/showbug.cgi?id=697500 POC to trigger null pointer dereference mutool After some fuzz testing I found a crashing test case. Git HEAD: 8eea208e099614487e4bd7cc0d67d91489dae642 To reproduce: mutool convert -F cbz...

Artifex MuPDF mujstest 1.10a - Null Pointer Dereference Vulnerability

Exploit for linux platform in category dos / poc Source: http://seclists.org/oss-sec/2017/q1/458 Description: Mujstest, which is part of mupdf is a scriptable tester for mupdf + js. A crafted image posted early for another issue, causes a stack overflow. The complete ASan output: mujstest $FILE...

Artifex MuPDF - Null Pointer Dereference

Artifex MuPDF - Null Pointer Dereference Source: https://bugs.ghostscript.com/showbug.cgi?id=697500 POC to trigger null pointer dereference mutool After some fuzz testing I found a crashing test case. Git HEAD: 8eea208e099614487e4bd7cc0d67d91489dae642 To reproduce: mutool convert -F cbz...

GLSA-201706-08 : MuPDF: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201706-08 MuPDF: Multiple vulnerabilities Multiple vulnerabilities have been discovered in MuPDF. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to process a speciall...

Artifex MuPDF - Null Pointer Dereference

Source: https://bugs.ghostscript.com/showbug.cgi?id=697500 POC to trigger null pointer dereference mutool After some fuzz testing I found a crashing test case. Git HEAD: 8eea208e099614487e4bd7cc0d67d91489dae642 To reproduce: mutool convert -F cbz nullptrfzpaintpixmapwithmask -o /dev/null ASAN:...

MuPDF: Multiple vulnerabilities

Background A lightweight PDF, XPS, and E-book viewer. Description Multiple vulnerabilities have been discovered in MuPDF. Please review the CVE identifiers referenced below for details. Impact A remote attacker could entice a user to process a specially crafted PDF document or image using MuPDF,...

Artifex Software MuPDF Security Vulnerability

Artifex Software MuPDF is a free, lightweight PDF reader from Artifex Software, USA. A memory corruption vulnerability exists in Artifex Software MuPDF version 1.9 and 1.10 RC2. An attacker can exploit this vulnerability to execute arbitrary code or cause a denial of service...

Artifex Software MuPDF Buffer Overflow Vulnerability (CNVD-2017-08509)

Artifex Software MuPDF is a free, lightweight PDF reader from Artifex Software, USA. A heap buffer overflow vulnerability exists in Artifex Software MuPDF version 1.10-rc1, which stems from the program failing to adequately perform boundary detection on user-submitted input. An attacker could...

Fedora 25 : mupdf (2017-5135c91b36)

Fix for CVE-2016-8728 CVE-2016-8729 ---- Rebuild with new jbig2dec Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...