CVE-2018-1000039

In Artifex MuPDF 1.12.0 and earlier, multiple heap use after free bugs in the PDF parser could allow an attacker to execute arbitrary code, read memory, or cause a denial of service via a crafted file...

CVE-2018-1000037

In Artifex MuPDF 1.12.0 and earlier, multiple reachable assertions in the PDF parser allow an attacker to cause a denial of service assert crash via a crafted file...

CVE-2018-1000038

CVE-2018-1000038 affects MuPDF up to version 1.12.0, where a stack buffer overflow in pdf_lookup_cmap_full (pdf/pdf-cmap.c) could let an attacker execute arbitrary code via a crafted file. Gentoo GLSA and related advisories list MuPDF as vulnerable and recommend upgrading to MuPDF 1.13.0 or later...

CVE-2018-1000038

In Artifex MuPDF 1.12.0 and earlier, a stack buffer overflow in function pdflookupcmapfull in pdf/pdf-cmap.c could allow an attacker to execute arbitrary code via a crafted file...

Denial Of Service (DoS)

MuPDF is vulnerable to denial of serviceDoS. The vulnerability is caused by the use of uninitialized-value in the PDF parser when a malicious file is input...

Denial Of Service (DoS)

MuPDF is vulnerable to denial of serviceDoS. It causes multiple heap-use-after-free reads after free bugs if the attacker inputs a malicious file. It can also lead to arbitrary code execution...

PT-2018-9227 · Artifex +1 · Mupdf +1

Name of the Vulnerable Software and Affected Versions: Artifex MuPDF versions 1.12.0 and earlier Description: The issue is related to multiple heap use after free bugs in the PDF parser, which could allow an attacker to execute arbitrary code, read memory, or cause a denial of service via a craft...

PT-2018-9225 · Artifex +1 · Mupdf +1

Name of the Vulnerable Software and Affected Versions: Artifex MuPDF versions 1.12.0 and earlier Description: The issue allows an attacker to cause a denial of service via a crafted file, exploiting multiple reachable assertions in the PDF parser. Recommendations: For Artifex MuPDF versions 1.12....

PT-2018-9228 · Artifex +1 · Mupdf +1

Name of the Vulnerable Software and Affected Versions: Artifex MuPDF versions 1.12.0 and earlier Description: The issue is related to multiple use of uninitialized value bugs in the PDF parser, which could allow an attacker to cause a denial of service crash or influence program flow via a crafte...

PT-2018-9226 · Artifex +1 · Mupdf +1

Name of the Vulnerable Software and Affected Versions: Artifex MuPDF versions 1.12.0 and earlier Description: A stack buffer overflow in the pdf lookup cmap full function in pdf/pdf-cmap.c could allow an attacker to execute arbitrary code via a crafted file. This issue affects the MuPDF library,...

PT-2018-9224 · Artifex +1 · Mupdf +1

Name of the Vulnerable Software and Affected Versions: MuPDF versions 1.12.0 and earlier Description: The issue is related to multiple memory leaks in the PDF parser, which can be exploited by an attacker to cause a denial of service memory leak via a crafted file. Recommendations: For MuPDF...

Integer Overflow

MuPDF is vulnerable to integer overflow. The attack can happen because of the incorrect exponent validation in the jsstrtod function in jsdtoa.c...

[ASA-201805-12] zathura-pdf-mupdf: multiple issues

Arch Linux Security Advisory ASA-201805-12 ========================================== Severity: High Date : 2018-05-16 CVE-ID : CVE-2018-5686 CVE-2018-6187 CVE-2018-6192 CVE-2018-6544 CVE-2018-1000051 Package : zathura-pdf-mupdf Type : multiple issues Remote : Yes Link :...

mupdf/pdf_fuzzer: Use-of-uninitialized-value in fz_unpack_tile

Project: git://git.ghostscript.com/mupdf.git Detailed report: https://oss-fuzz.com/testcase?key=5631625898491904 Project: mupdf Fuzzer: libFuzzermupdfpdffuzzer Fuzz target binary: pdffuzzer Job Type: libfuzzermsanmupdf Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

mupdf/pdf_fuzzer: Use-of-uninitialized-value in cf2_glyphpath_lineTo

Project: git://git.ghostscript.com/mupdf.git Detailed report: https://oss-fuzz.com/testcase?key=5724012322750464 Project: mupdf Fuzzer: libFuzzermupdfpdffuzzer Fuzz target binary: pdffuzzer Job Type: libfuzzermsanmupdf Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

[ASA-201805-7] mupdf-tools: multiple issues

Arch Linux Security Advisory ASA-201805-7 ========================================= Severity: High Date : 2018-05-10 CVE-ID : CVE-2018-5686 CVE-2018-6187 CVE-2018-6192 CVE-2018-6544 CVE-2018-1000051 Package : mupdf-tools Type : multiple issues Remote : Yes Link :...

[ASA-201805-5] mupdf-gl: multiple issues

Arch Linux Security Advisory ASA-201805-5 ========================================= Severity: High Date : 2018-05-10 CVE-ID : CVE-2018-5686 CVE-2018-6187 CVE-2018-6192 CVE-2018-6544 CVE-2018-1000051 Package : mupdf-gl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-6...

[ASA-201805-4] mupdf: multiple issues

Arch Linux Security Advisory ASA-201805-4 ========================================= Severity: High Date : 2018-05-09 CVE-ID : CVE-2018-5686 CVE-2018-6187 CVE-2018-6192 CVE-2018-6544 CVE-2018-1000051 Package : mupdf Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-609...

Memory corruption

An exploitable memory corruption vulnerability exists in the JBIG2 parser of Artifex MuPDF 1.9. A specially crafted PDF can cause a negative number to be passed to a memset resulting in memory corruption and potential code execution. An attacker can specially craft a PDF and send to the victim to...

CVE-2016-8729

An exploitable memory corruption vulnerability exists in the JBIG2 parser of Artifex MuPDF 1.9. A specially crafted PDF can cause a negative number to be passed to a memset resulting in memory corruption and potential code execution. An attacker can specially craft a PDF and send to the victim to...