Debian Mupdf vulnerabilities

CVE-2018-6187 [MEDIUM] CVE-2018-6187: mupdf - In Artifex MuPDF 1.12.0, there is a heap-based buffer overflow vulnerability in ... In Artifex MuPDF 1.12.0, there is a heap-based buffer overflow vulnerability in the do_pdf_save_document function in the pdf/pdf-write.c file. Remote attackers could leverage the vulnerability to cause a denial of service via a crafted pdf file. Scope: local bookworm: resolved (fixed in 1.13.0+ds1-1) bullseye: resolved (fixed in 1.13.0+ds1-1) forky: resolved (fixed in

CVE-2016-10247 [MEDIUM] CVE-2016-10247: mupdf - Buffer overflow in the my_getline function in jstest_main.c in Mujstest in Artif... Buffer overflow in the my_getline function in jstest_main.c in Mujstest in Artifex Software, Inc. MuPDF before 1.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file. Scope: local bookworm: resolved (fixed in 1.11+ds1-1) bullseye: resolved (fixed in 1.11+ds1-1) forky: resolved (fixed in 1.11+ds1-1) sid: resolved (fixed in

CVE-2016-10246 [MEDIUM] CVE-2016-10246: mupdf - Buffer overflow in the main function in jstest_main.c in Mujstest in Artifex Sof... Buffer overflow in the main function in jstest_main.c in Mujstest in Artifex Software, Inc. MuPDF before 1.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file. Scope: local bookworm: resolved (fixed in 1.11+ds1-1) bullseye: resolved (fixed in 1.11+ds1-1) forky: resolved (fixed in 1.11+ds1-1) sid: resolved (fixed in 1.11+d

CVE-2020-19609 [MEDIUM] CVE-2020-19609: mupdf - Artifex MuPDF before 1.18.0 has a heap based buffer over-write in tiff_expand_co... Artifex MuPDF before 1.18.0 has a heap based buffer over-write in tiff_expand_colormap() function when parsing TIFF files allowing attackers to cause a denial of service. Scope: local bookworm: resolved (fixed in 1.17.0+ds1-2) bullseye: resolved (fixed in 1.17.0+ds1-2) forky: resolved (fixed in 1.17.0+ds1-2) sid: resolved (fixed in 1.17.0+ds1-2) trixie: resolved (fi

CVE-2021-37220 [MEDIUM] CVE-2021-37220: mupdf - MuPDF through 1.18.1 has an out-of-bounds write because the cached color convert... MuPDF through 1.18.1 has an out-of-bounds write because the cached color converter does not properly consider the maximum key size of a hash table. This can, for example, be seen with crafted "mutool draw" input. Scope: local bookworm: resolved (fixed in 1.17.0+ds1-2) bullseye: resolved (fixed in 1.17.0+ds1-2) forky: resolved (fixed in 1.17.0+ds1-2) sid: resolved (f

CVE-2020-26519 [MEDIUM] CVE-2020-26519: mupdf - Artifex MuPDF before 1.18.0 has a heap based buffer over-write when parsing JBIG... Artifex MuPDF before 1.18.0 has a heap based buffer over-write when parsing JBIG2 files allowing attackers to cause a denial of service. Scope: local bookworm: resolved (fixed in 1.17.0+ds1-1.1) bullseye: resolved (fixed in 1.17.0+ds1-1.1) forky: resolved (fixed in 1.17.0+ds1-1.1) sid: resolved (fixed in 1.17.0+ds1-1.1) trixie: resolved (fixed in 1.17.0+ds1-1.1)

CVE-2017-7264 [MEDIUM] CVE-2017-7264: mupdf - Use-after-free vulnerability in the fz_subsample_pixmap function in fitz/pixmap.... Use-after-free vulnerability in the fz_subsample_pixmap function in fitz/pixmap.c in Artifex MuPDF 1.10a allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted document. Scope: local bookworm: resolved (fixed in 1.9a+ds1-3) bullseye: resolved (fixed in 1.9a+ds1-3) forky: resolved (fixed in 1.9a+

CVE-2018-1000037 [MEDIUM] CVE-2018-1000037: mupdf - In Artifex MuPDF 1.12.0 and earlier, multiple reachable assertions in the PDF pa... In Artifex MuPDF 1.12.0 and earlier, multiple reachable assertions in the PDF parser allow an attacker to cause a denial of service (assert crash) via a crafted file. Scope: local bookworm: resolved (fixed in 1.13.0+ds1-1) bullseye: resolved (fixed in 1.13.0+ds1-1) forky: resolved (fixed in 1.13.0+ds1-1) sid: resolved (fixed in 1.13.0+ds1-1) trixie: resolved (fi

CVE-2020-21896 [MEDIUM] CVE-2020-21896: mupdf - A Use After Free vulnerability in svg_dev_text_span_as_paths_defs function in so... A Use After Free vulnerability in svg_dev_text_span_as_paths_defs function in source/fitz/svg-device.c in Artifex Software MuPDF 1.16.0 allows remote attackers to cause a denial of service via opening of a crafted PDF file. Scope: local bookworm: resolved (fixed in 1.19.0+ds1-1) bullseye: resolved (fixed in 1.17.0+ds1-2+deb11u1) forky: resolved (fixed in 1.19.0+ds1-

CVE-2020-26683 [MEDIUM] CVE-2020-26683: mupdf - A memory leak issue discovered in /pdf/pdf-font-add.c in Artifex Software MuPDF ... A memory leak issue discovered in /pdf/pdf-font-add.c in Artifex Software MuPDF 1.17.0 allows attackers to obtain sensitive information. Scope: local bookworm: resolved (fixed in 1.19.0+ds1-1) bullseye: open forky: resolved (fixed in 1.19.0+ds1-1) sid: resolved (fixed in 1.19.0+ds1-1) trixie: resolved (fixed in 1.19.0+ds1-1)

CVE-2016-6265 [MEDIUM] CVE-2016-6265: mupdf - Use-after-free vulnerability in the pdf_load_xref function in pdf/pdf-xref.c in ... Use-after-free vulnerability in the pdf_load_xref function in pdf/pdf-xref.c in MuPDF allows remote attackers to cause a denial of service (crash) via a crafted PDF file. Scope: local bookworm: resolved (fixed in 1.9a+ds1-1.1) bullseye: resolved (fixed in 1.9a+ds1-1.1) forky: resolved (fixed in 1.9a+ds1-1.1) sid: resolved (fixed in 1.9a+ds1-1.1) trixie: resolved (fixe

CVE-2018-18662 [MEDIUM] CVE-2018-18662: mupdf - There is an out-of-bounds read in fz_run_t3_glyph in fitz/font.c in Artifex MuPD... There is an out-of-bounds read in fz_run_t3_glyph in fitz/font.c in Artifex MuPDF 1.14.0, as demonstrated by mutool. Scope: local bookworm: resolved (fixed in 1.14.0+ds1-3) bullseye: resolved (fixed in 1.14.0+ds1-3) forky: resolved (fixed in 1.14.0+ds1-3) sid: resolved (fixed in 1.14.0+ds1-3) trixie: resolved (fixed in 1.14.0+ds1-3)

CVE-2018-6544 [MEDIUM] CVE-2018-6544: mupdf - pdf_load_obj_stm in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 could reference the o... pdf_load_obj_stm in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 could reference the object stream recursively and therefore run out of error stack, which allows remote attackers to cause a denial of service via a crafted PDF document. Scope: local bookworm: resolved (fixed in 1.12.0+ds1-1) bullseye: resolved (fixed in 1.12.0+ds1-1) forky: resolved (fixed in 1.12.0+ds1-1) s

CVE-2019-6131 [MEDIUM] CVE-2019-6131: mupdf - svg-run.c in Artifex MuPDF 1.14.0 has infinite recursion with stack consumption ... svg-run.c in Artifex MuPDF 1.14.0 has infinite recursion with stack consumption in svg_run_use_symbol, svg_run_element, and svg_run_use, as demonstrated by mutool. Scope: local bookworm: resolved (fixed in 1.14.0+ds1-3) bullseye: resolved (fixed in 1.14.0+ds1-3) forky: resolved (fixed in 1.14.0+ds1-3) sid: resolved (fixed in 1.14.0+ds1-3) trixie: resolved (fixed in 1.

CVE-2018-1000040 [MEDIUM] CVE-2018-1000040: mupdf - In Artifex MuPDF 1.12.0 and earlier, multiple use of uninitialized value bugs in... In Artifex MuPDF 1.12.0 and earlier, multiple use of uninitialized value bugs in the PDF parser could allow an attacker to cause a denial of service (crash) or influence program flow via a crafted file. Scope: local bookworm: resolved (fixed in 1.13.0+ds1-1) bullseye: resolved (fixed in 1.13.0+ds1-1) forky: resolved (fixed in 1.13.0+ds1-1) sid: resolved (fixed i

CVE-2018-16648 [MEDIUM] CVE-2018-16648: mupdf - In Artifex MuPDF 1.13.0, the fz_append_byte function in fitz/buffer.c allows rem... In Artifex MuPDF 1.13.0, the fz_append_byte function in fitz/buffer.c allows remote attackers to cause a denial of service (segmentation fault) via a crafted pdf file. This is caused by a pdf/pdf-device.c pdf_dev_alpha array-index underflow. Scope: local bookworm: resolved (fixed in 1.14.0+ds1-4) bullseye: resolved (fixed in 1.14.0+ds1-4) forky: resolved (fixed in 1

CVE-2018-19881 [MEDIUM] CVE-2018-19881: mupdf - In Artifex MuPDF 1.14.0, svg/svg-run.c allows remote attackers to cause a denial... In Artifex MuPDF 1.14.0, svg/svg-run.c allows remote attackers to cause a denial of service (recursive calls followed by a fitz/xml.c fz_xml_att crash from excessive stack consumption) via a crafted svg file, as demonstrated by mupdf-gl. Scope: local bookworm: resolved (fixed in 1.15.0+ds1-1) bullseye: resolved (fixed in 1.15.0+ds1-1) forky: resolved (fixed in 1.15.

CVE-2019-6130 [MEDIUM] CVE-2019-6130: mupdf - Artifex MuPDF 1.14.0 has a SEGV in the function fz_load_page of the fitz/documen... Artifex MuPDF 1.14.0 has a SEGV in the function fz_load_page of the fitz/document.c file, as demonstrated by mutool. This is related to page-number mishandling in cbz/mucbz.c, cbz/muimg.c, and svg/svg-doc.c. Scope: local bookworm: resolved (fixed in 1.14.0+ds1-3) bullseye: resolved (fixed in 1.14.0+ds1-3) forky: resolved (fixed in 1.14.0+ds1-3) sid: resolved (fixed in

CVE-2018-16647 [MEDIUM] CVE-2018-16647: mupdf - In Artifex MuPDF 1.13.0, the pdf_get_xref_entry function in pdf/pdf-xref.c allow... In Artifex MuPDF 1.13.0, the pdf_get_xref_entry function in pdf/pdf-xref.c allows remote attackers to cause a denial of service (segmentation fault in fz_write_data in fitz/output.c) via a crafted pdf file. Scope: local bookworm: resolved (fixed in 1.14.0+ds1-4) bullseye: resolved (fixed in 1.14.0+ds1-4) forky: resolved (fixed in 1.14.0+ds1-4) sid: resolved (fixed i

CVE-2021-4216 [MEDIUM] CVE-2021-4216: mupdf - A Floating point exception (division-by-zero) flaw was found in Mupdf for zero w... A Floating point exception (division-by-zero) flaw was found in Mupdf for zero width pages in muraster.c. It is fixed in Mupdf-1.20.0-rc1 upstream. Scope: local bookworm: resolved (fixed in 1.20.0+ds1-1) bullseye: open forky: resolved (fixed in 1.20.0+ds1-1) sid: resolved (fixed in 1.20.0+ds1-1) trixie: resolved (fixed in 1.20.0+ds1-1)