CVE-2018-10289

In MuPDF 1.13.0, there is an infinite loop in the fzskipspace function of the pdf/pdf-xref.c file. A remote adversary could leverage this vulnerability to cause a denial of service via a crafted pdf file...

PT-2018-9803 · Artifex +1 · Mupdf +1

Name of the Vulnerable Software and Affected Versions: MuPDF version 1.13.0 Description: The issue is related to an infinite loop in the fz skip space function of the pdf/pdf-xref.c file. This could allow a remote adversary to cause a denial of service via a crafted pdf file. Recommendations: For...

mupdf/pdf_fuzzer: Heap-use-after-free in fz_drop_imp

Project: git://git.ghostscript.com/mupdf.git Detailed report: https://oss-fuzz.com/testcase?key=5782684270854144 Project: mupdf Fuzzer: aflmupdfpdffuzzer Fuzz target binary: pdffuzzer Job Type: aflasanmupdf Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x6080000005a0...

mupdf/pdf_fuzzer: Use-of-uninitialized-value in fz_drop_imp

Project: git://git.ghostscript.com/mupdf.git Detailed report: https://oss-fuzz.com/testcase?key=5667955980369920 Project: mupdf Fuzzer: libFuzzermupdfpdffuzzer Fuzz target binary: pdffuzzer Job Type: libfuzzermsanmupdf Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

Debian DSA-4152-1 : mupdf - security update

Two vulnerabilities were discovered in MuPDF, a PDF, XPS, and e-book viewer, which may result in denial of service or remote code execution. An attacker can craft a PDF document which, when opened in the victim host, might consume vast amounts of memory, crash the program, or, in some cases,...

[SECURITY] [DSA 4152-1] mupdf security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4152-1 [email protected] https://www.debian.org/security/ Luciano Bello March 27, 2018 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4152-1] mupdf security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4152-1 [email protected] https://www.debian.org/security/ Luciano Bello March 27, 2018 https://www.debian.org/security/faq -...

DSA-4152-1 mupdf - security update

Bulletin has no description...

Debian: Security Advisory (DSA-4152-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

mupdf/pdf_fuzzer: Use-of-uninitialized-value in jbig2_arith_decode

Project: git://git.ghostscript.com/mupdf.git Detailed report: https://oss-fuzz.com/testcase?key=5829721259507712 Project: mupdf Fuzzer: libFuzzermupdfpdffuzzer Fuzz target binary: pdffuzzer Job Type: libfuzzermsanmupdf Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

mupdf/pdf_fuzzer: Use-of-uninitialized-value in fz_keep_imp

Project: git://git.ghostscript.com/mupdf.git Detailed report: https://oss-fuzz.com/testcase?key=4807604346814464 Project: mupdf Fuzzer: libFuzzermupdfpdffuzzer Fuzz target binary: pdffuzzer Job Type: libfuzzermsanmupdf Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

Artifex Software MuPDF 'count_entries' function stack buffer overflow vulnerability

Artifex Software MuPDF is a PDF library from Artifex Software, USA. A security vulnerability exists in the 'countentries' function in the pdf-layer.c file in Artifex Software MuPDF version 1.10a. A remote attacker can exploit this vulnerability to cause a denial of service stack consumption and...

mupdf/pdf_fuzzer: Crash in template_affine_color_N_lerp

Project: git://git.ghostscript.com/mupdf.git Detailed report: https://oss-fuzz.com/testcase?key=5671645147561984 Project: mupdf Fuzzer: libFuzzermupdfpdffuzzer Fuzz target binary: pdffuzzer Job Type: libfuzzermsanmupdf Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7f365e761f44 Cras...

Fedora 27 : mupdf (2018-da6f76b446)

CVE-2018-6192 CVE-2018-6544 CVE-2018-1000051 CVE-2018-6187 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

[SECURITY] Fedora 27 Update: mupdf-1.12.0-5.fc27

MuPDF is a lightweight PDF viewer and toolkit written in portable C. The renderer in MuPDF is tailored for high quality anti-aliased graphics. MuPDF renders text with metrics and spacing accurate to within fractions of a pixel for the highest fidelity in reproducing the look of a printed page on...

Fedora Update for mupdf FEDORA-2018-da6f76b446

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Update : mupdf (openSUSE-2018-167)

This update for mupdf fixes the following issues : - CVE-2018-1000051: Fixed a use-after-free vulnerability in fzkeepkeystorable that can potentially result in DoS / remote code execution boo1080531 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in th...

mupdf/pdf_fuzzer: Use-of-uninitialized-value in pdf_parse_file_spec

Project: git://git.ghostscript.com/mupdf.git Detailed report: https://oss-fuzz.com/testcase?key=5996991491342336 Project: mupdf Fuzzer: libFuzzermupdfpdffuzzer Fuzz target binary: pdffuzzer Job Type: libfuzzermsanmupdf Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

Denial Of Service (DoS)

MuPDF is vulnerable to denial of service DoS attacks. The application contains a use-after-free bug, allowing a malicious user to crash the application or possibly inject and execute arbitrary code...

DEBIAN-CVE-2018-1000051

Artifex Mupdf version 1.12.0 contains a Use After Free vulnerability in fzkeepkeystorable that can result in DOS / Possible code execution. This attack appear to be exploitable via Victim opens a specially crafted PDF...