Multiple vulnerabilities in MuPDF



Published: 2017-06-06 | Updated: 2017-06-07
Risk Low
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2016-10221
CVE-2017-5991
CVE-2017-6060
CWE-ID CWE-121
CWE-476
Exploitation vector Network
Public exploit Public exploit code for vulnerability #2 is available.
Public exploit code for vulnerability #3 is available.
Vulnerable software
Subscribe 		MuPDF
Client/Desktop applications / Multimedia software

Vendor Artifex Software, Inc.

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Stack overflow

EUVDB-ID: #VU6920

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-10221

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the count_entries() function in pdf-layer.c in MuPDF 1.10a. A remote attacker can create a specially crafted PDF file, trick the victim into opening it and crash, trigger stack overflow and crash the application.

Mitigation

Update to version 1.11-r1.

Vulnerable software versions

MuPDF: 0.5 - 1.10a

External links

http://bugs.ghostscript.com/show_bug.cgi?id=697400


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Null pointer dereference

EUVDB-ID: #VU6921

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C]

CVE-ID: CVE-2017-5991

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: Yes

Description

An issue was discovered in Artifex Software, Inc. MuPDF before 1912de5f08e90af1d9d0a9791f58ba3afdb9d465. The pdf_run_xobject function in pdf-op-run.c encounters a NULL pointer dereference during a Fitz fz_paint_pixmap_with_mask painting operation.

Mitigation

Update to version 1.11-r1.

Vulnerable software versions

MuPDF: 1.10a


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

3) Stack-based buffer overflow

EUVDB-ID: #VU6922

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C]

CVE-ID: CVE-2017-6060

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: Yes

Description

Stack-based buffer overflow in jstest_main.c in mujstest in Artifex Software, Inc. MuPDF 1.10a allows remote attackers to have unspecified impact via a crafted image.

Mitigation

Update to version 1.11-r1.

Vulnerable software versions

MuPDF: 1.10a


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.



###SIDEBAR###