Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2017-6060 — Out-of-bounds Write in Mupdf

CWE-787 — Out-of-bounds Write10 documents7 sources
Severity
7.8HIGHNVD
EPSS
2.9%
top 13.59%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Artifex MupdfDebian Linux
Timeline
PublishedMar 15
Latest updateMay 13

Description

Stack-based buffer overflow in jstest_main.c in mujstest in Artifex Software, Inc. MuPDF 1.10a allows remote attackers to have unspecified impact via a crafted image.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶Debianartifex/mupdf< 1.12.0+ds1-1+3
▶NVDartifex/mupdf1.10a

Also affects: Debian Linux 9.0

🔴Vulnerability Details

3
GHSA
GHSA-c4jh-pwxf-76p2: Stack-based buffer overflow in jstest_main↗2022-05-13
▶
CVEList
CVE-2017-6060: Stack-based buffer overflow in jstest_main↗2017-03-15
▶
OSV
CVE-2017-6060: Stack-based buffer overflow in jstest_main↗2017-03-15
▶

💥Exploits & PoCs

1
Exploit-DB
Artifex MuPDF mujstest 1.10a - Null Pointer Dereference↗2017-02-17
▶

📋Vendor Advisories

1
Debian
CVE-2017-6060: mupdf - Stack-based buffer overflow in jstest_main.c in mujstest in Artifex Software, In...↗2017
▶

💬Community

4
Bugzilla
qt5-qtwebengine: 16 security vulnerabilities↗2018-03-24
▶
Bugzilla
CVE-2017-6060 mupdf: Stack-based buffer overflow in jstest_main.c↗2017-02-21
▶
Bugzilla
CVE-2017-6060 mupdf: Stack-based buffer overflow in jstest_main.c [fedora-all]↗2017-02-21
▶
Bugzilla
CVE-2016-6525 CVE-2016-8674 CVE-2017-5896 mupdf: various flaws [fedora-all]↗2016-08-03
▶
CVE-2017-6060 — Out-of-bounds Write in Artifex Mupdf | cvebase