Arch Linux Security Advisory ASA-201711-5 ========================================= Severity: High Date : 2017-11-01 CVE-ID : CVE-2017-14685 CVE-2017-14686 CVE-2017-14687 CVE-2017-15587 Package : zathura-pdf-mupdf Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-476 Summary ======= The package zathura-pdf-mupdf before version 0.3.1-4 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 0.3.1-4. # pacman -Syu "zathura-pdf-mupdf>=0.3.1-4" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-14685 (arbitrary code execution) Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. This occurs because xps_load_links_in_glyphs in xps/xps-link.c does not verify that an xps font could be loaded. - CVE-2017-14686 (arbitrary code execution) Artifex MuPDF 1.11 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file. This occurs because read_zip_dir_imp in fitz/unzip.c does not check whether size fields in a ZIP entry are negative numbers. - CVE-2017-14687 (arbitrary code execution) Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. This occurs because of mishandling of XML tag name comparisons. - CVE-2017-15587 (arbitrary code execution) An integer overflow leading to an out-of-bounds wrte has been found in mupdf <= 1.11. The parsing of a crafted PDF might allow an attacker to write controlled data to an arbitrary location in memory when performing truncated xref checks. Impact ====== An attacker is able to execute arbitrary code on the affected host by providing a maliciously-crafted .xps or .pdf file to the zathura process. References ========== http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=ab1a420613dec93c686ac... https://bugs.ghostscript.com/show_bug.cgi?id=698539 http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=0f0fbc07d9be31f5e83ec... https://bugs.ghostscript.com/show_bug.cgi?id=698540 http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=2b16dbd8f73269cb15ca6... https://bugs.ghostscript.com/show_bug.cgi?id=698558 https://nandynarwhals.org/CVE-2017-15587/ http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=82df2631d7d0446b206ea... https://security.archlinux.org/CVE-2017-14685 https://security.archlinux.org/CVE-2017-14686 https://security.archlinux.org/CVE-2017-14687 https://security.archlinux.org/CVE-2017-15587