Arch Linux Security Advisory ASA-201805-4 ========================================= Severity: High Date : 2018-05-09 CVE-ID : CVE-2018-5686 CVE-2018-6187 CVE-2018-6192 CVE-2018-6544 CVE-2018-1000051 Package : mupdf Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-609 Summary ======= The package mupdf before version 1.13.0-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 1.13.0-1. # pacman -Syu "mupdf>=1.13.0-1" The problems have been fixed upstream in version 1.13.0. Workaround ========== None. Description =========== - CVE-2018-5686 (denial of service) In MuPDF 1.12.0, there is an infinite loop vulnerability and application hang in the pdf_parse_array function (pdf/pdf-parse.c) because EOF is not considered. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted pdf file. - CVE-2018-6187 (denial of service) In Artifex MuPDF 1.12.0, there is a heap-based buffer overflow vulnerability in the do_pdf_save_document function in the pdf/pdf- write.c file. Remote attackers could leverage the vulnerability to cause a denial of service via a crafted pdf file. - CVE-2018-6192 (denial of service) In Artifex MuPDF 1.12.0, the pdf_read_new_xref function in pdf/pdf- xref.c allows remote attackers to cause a denial of service (segmentation violation and application crash) via a crafted pdf file. - CVE-2018-6544 (denial of service) pdf_load_obj_stm in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 could reference the object stream recursively and therefore run out of error stack, which allows remote attackers to cause a denial of service via a crafted PDF document. - CVE-2018-1000051 (arbitrary code execution) Artifex Mupdf version 1.12.0 contains a Use After Free vulnerability in fz_keep_key_storable that can result in DOS / Possible code execution. This attack appear to be exploitable via Victim opens a specially crafted PDF. Impact ====== A remote attacker is able to crash the application or execute arbitrary code via a specially crafted PDF file. References ========== https://bugs.archlinux.org/task/57486 https://bugs.ghostscript.com/show_bug.cgi?id=698860 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=b70eb93f6936c03d8af5... https://bugs.ghostscript.com/show_bug.cgi?id=698908 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=3e30fbb7bf5efd88df43... https://bugs.ghostscript.com/show_bug.cgi?id=698916 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=5e411a99604ff6be5db9... https://git.ghostscript.com/?p=mupdf.git;h=fa9cd085533f68367c299e058ab3fbb7a... https://bugs.ghostscript.com/show_bug.cgi?id=698965 https://bugs.ghostscript.com/show_bug.cgi?id=698830 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=b03def134988da8c800a... https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=26527eef77b3e51c2258... https://bugs.ghostscript.com/show_bug.cgi?id=698825 https://bugs.ghostscript.com/show_bug.cgi?id=698873 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=321ba1de287016b0036b... https://security.archlinux.org/CVE-2018-5686 https://security.archlinux.org/CVE-2018-6187 https://security.archlinux.org/CVE-2018-6192 https://security.archlinux.org/CVE-2018-6544 https://security.archlinux.org/CVE-2018-1000051