CVE-2018-6544 — Uncontrolled Recursion in Mupdf

CWE-674 — Uncontrolled Recursion7 documents6 sources
Severity
5.5MEDIUMNVD
EPSS
0.4%
top 41.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Artifex MupdfDebian Linux
Timeline
PublishedFeb 2
Latest updateMay 13

Description

pdf_load_obj_stm in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 could reference the object stream recursively and therefore run out of error stack, which allows remote attackers to cause a denial of service via a crafted PDF document.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages2 packages

▶Debianartifex/mupdf< 1.12.0+ds1-1+3
▶NVDartifex/mupdf1.12.0

Also affects: Debian Linux 8.0, 9.0

🔴Vulnerability Details

3
GHSA
GHSA-3vq6-g92c-jm9j: pdf_load_obj_stm in pdf/pdf-xref↗2022-05-13
▶
CVEList
CVE-2018-6544: pdf_load_obj_stm in pdf/pdf-xref↗2018-02-02
▶
OSV
CVE-2018-6544: pdf_load_obj_stm in pdf/pdf-xref↗2018-02-02
▶

📋Vendor Advisories

1
Debian
CVE-2018-6544: mupdf - pdf_load_obj_stm in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 could reference the o...↗2018
▶

💬Community

2
Bugzilla
CVE-2018-6544 mupdf: denial of service (DoS) via a crafted PDF document [fedora-all]↗2018-02-06
▶
Bugzilla
CVE-2018-6544 mupdf: denial of service (DoS) via a crafted PDF document↗2018-02-06
▶
CVE-2018-6544 — Uncontrolled Recursion in Artifex Mupdf | cvebase