SB2017021904 - Gentoo update for MuPDF
Published: February 19, 2017 Updated: February 19, 2017
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2016-6265)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing a crafted PDF file. A remote attackers can cause a denial of service (crash).
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
2) Heap-based buffer overflow (CVE-ID: CVE-2016-6525)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in Heap-based buffer overflow in the pdf_load_mesh_params function in pdf/pdf-shade.c in MuPDF. A remote attacker can use a large decode array. to trigger heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) Heap-based buffer overflow (CVE-ID: CVE-2017-5896)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in Heap-based buffer overflow in the fz_subsample_pixmap function in fitz/pixmap.c in MuPDF 1.10a. A remote attacker can use a crafted image. to trigger heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install update from vendor's website.