CVE-2018-1000039

In Artifex MuPDF 1.12.0 and earlier, multiple heap use after free bugs in the PDF parser could allow an attacker to execute arbitrary code, read memory, or cause a denial of service via a crafted file...

CVE-2018-1000037

In Artifex MuPDF 1.12.0 and earlier, multiple reachable assertions in the PDF parser allow an attacker to cause a denial of service assert crash via a crafted file...

CVE-2018-1000038

CVE-2018-1000038 affects MuPDF up to version 1.12.0, where a stack buffer overflow in pdf_lookup_cmap_full (pdf/pdf-cmap.c) could let an attacker execute arbitrary code via a crafted file. Gentoo GLSA and related advisories list MuPDF as vulnerable and recommend upgrading to MuPDF 1.13.0 or later...

CVE-2018-1000038

In Artifex MuPDF 1.12.0 and earlier, a stack buffer overflow in function pdflookupcmapfull in pdf/pdf-cmap.c could allow an attacker to execute arbitrary code via a crafted file...

Denial Of Service (DoS)

MuPDF is vulnerable to denial of serviceDoS. The vulnerability is caused by the use of uninitialized-value in the PDF parser when a malicious file is input...

Denial Of Service (DoS)

MuPDF is vulnerable to denial of serviceDoS. It causes multiple heap-use-after-free reads after free bugs if the attacker inputs a malicious file. It can also lead to arbitrary code execution...

PT-2018-9225 · Artifex +1 · Mupdf +1

Name of the Vulnerable Software and Affected Versions: Artifex MuPDF versions 1.12.0 and earlier Description: The issue allows an attacker to cause a denial of service via a crafted file, exploiting multiple reachable assertions in the PDF parser. Recommendations: For Artifex MuPDF versions 1.12....

PT-2018-9228 · Artifex +1 · Mupdf +1

Name of the Vulnerable Software and Affected Versions: Artifex MuPDF versions 1.12.0 and earlier Description: The issue is related to multiple use of uninitialized value bugs in the PDF parser, which could allow an attacker to cause a denial of service crash or influence program flow via a crafte...

PT-2018-9227 · Artifex +1 · Mupdf +1

Name of the Vulnerable Software and Affected Versions: Artifex MuPDF versions 1.12.0 and earlier Description: The issue is related to multiple heap use after free bugs in the PDF parser, which could allow an attacker to execute arbitrary code, read memory, or cause a denial of service via a craft...

PT-2018-9224 · Artifex +1 · Mupdf +1

Name of the Vulnerable Software and Affected Versions: MuPDF versions 1.12.0 and earlier Description: The issue is related to multiple memory leaks in the PDF parser, which can be exploited by an attacker to cause a denial of service memory leak via a crafted file. Recommendations: For MuPDF...

PT-2018-9226 · Artifex +1 · Mupdf +1

Name of the Vulnerable Software and Affected Versions: Artifex MuPDF versions 1.12.0 and earlier Description: A stack buffer overflow in the pdf lookup cmap full function in pdf/pdf-cmap.c could allow an attacker to execute arbitrary code via a crafted file. This issue affects the MuPDF library,...

Integer Overflow

MuPDF is vulnerable to integer overflow. The attack can happen because of the incorrect exponent validation in the jsstrtod function in jsdtoa.c...

[ASA-201805-12] zathura-pdf-mupdf: multiple issues

Arch Linux Security Advisory ASA-201805-12 ========================================== Severity: High Date : 2018-05-16 CVE-ID : CVE-2018-5686 CVE-2018-6187 CVE-2018-6192 CVE-2018-6544 CVE-2018-1000051 Package : zathura-pdf-mupdf Type : multiple issues Remote : Yes Link :...

mupdf/pdf_fuzzer: Use-of-uninitialized-value in fz_unpack_tile

Project: git://git.ghostscript.com/mupdf.git Detailed report: https://oss-fuzz.com/testcase?key=5631625898491904 Project: mupdf Fuzzer: libFuzzermupdfpdffuzzer Fuzz target binary: pdffuzzer Job Type: libfuzzermsanmupdf Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

mupdf/pdf_fuzzer: Use-of-uninitialized-value in cf2_glyphpath_lineTo

Project: git://git.ghostscript.com/mupdf.git Detailed report: https://oss-fuzz.com/testcase?key=5724012322750464 Project: mupdf Fuzzer: libFuzzermupdfpdffuzzer Fuzz target binary: pdffuzzer Job Type: libfuzzermsanmupdf Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

[ASA-201805-7] mupdf-tools: multiple issues

Arch Linux Security Advisory ASA-201805-7 ========================================= Severity: High Date : 2018-05-10 CVE-ID : CVE-2018-5686 CVE-2018-6187 CVE-2018-6192 CVE-2018-6544 CVE-2018-1000051 Package : mupdf-tools Type : multiple issues Remote : Yes Link :...

[ASA-201805-5] mupdf-gl: multiple issues

Arch Linux Security Advisory ASA-201805-5 ========================================= Severity: High Date : 2018-05-10 CVE-ID : CVE-2018-5686 CVE-2018-6187 CVE-2018-6192 CVE-2018-6544 CVE-2018-1000051 Package : mupdf-gl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-6...

[ASA-201805-4] mupdf: multiple issues

Arch Linux Security Advisory ASA-201805-4 ========================================= Severity: High Date : 2018-05-09 CVE-ID : CVE-2018-5686 CVE-2018-6187 CVE-2018-6192 CVE-2018-6544 CVE-2018-1000051 Package : mupdf Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-609...

Memory corruption

An exploitable memory corruption vulnerability exists in the JBIG2 parser of Artifex MuPDF 1.9. A specially crafted PDF can cause a negative number to be passed to a memset resulting in memory corruption and potential code execution. An attacker can specially craft a PDF and send to the victim to...

CVE-2016-8728

An exploitable heap out of bounds write vulnerability exists in the Fitz graphical library part of the MuPDF renderer. A specially crafted PDF file can cause a out of bounds write resulting in heap metadata and sensitive process memory corruption leading to potential code execution. Victim needs ...