Arch Linux: ASA-201711-5 High: Zathura PDF MuPDF Arbitrary Code Execution

Arch Linux Security Advisory ASA-201711-5
========================================
Severity: High
Date    : 2017-11-01
CVE-ID  : CVE-2017-14685 CVE-2017-14686 CVE-2017-14687 CVE-2017-15587
Package : zathura-pdf-mupdf
Type    : arbitrary code execution
Remote  : No
Link    : https://security.archlinux.org/AVG-476

Summary
======
The package zathura-pdf-mupdf before version 0.3.1-4 is vulnerable to
arbitrary code execution.

Resolution
=========
Upgrade to 0.3.1-4.

# pacman -Syu "zathura-pdf-mupdf>=0.3.1-4"

The problems have been fixed upstream but no release is available yet.

Workaround
=========
None.

Description
==========
- CVE-2017-14685 (arbitrary code execution)

Artifex MuPDF 1.11 allows attackers to cause a denial of service or
possibly have unspecified other impact via a crafted .xps file. This
occurs because xps_load_links_in_glyphs in xps/xps-link.c does not
verify that an xps font could be loaded.

- CVE-2017-14686 (arbitrary code execution)

Artifex MuPDF 1.11 allows attackers to execute arbitrary code or cause
a denial of service via a crafted .xps file. This occurs because
read_zip_dir_imp in fitz/unzip.c does not check whether size fields in
a ZIP entry are negative numbers.

- CVE-2017-14687 (arbitrary code execution)

Artifex MuPDF 1.11 allows attackers to cause a denial of service or
possibly have unspecified other impact via a crafted .xps file. This
occurs because of mishandling of XML tag name comparisons.

- CVE-2017-15587 (arbitrary code execution)

An integer overflow leading to an out-of-bounds wrte has been found in
mupdf <= 1.11. The parsing of a crafted PDF might allow an attacker to
write controlled data to an arbitrary location in memory when
performing truncated xref checks.

Impact
=====
An attacker is able to execute arbitrary code on the affected host by
providing a maliciously-crafted .xps or .pdf file to the zathura
process.

References
=========

https://bugs.ghostscript.com/show_bug.cgi?id=698539

https://bugs.ghostscript.com/show_bug.cgi?id=698540

https://bugs.ghostscript.com/show_bug.cgi?id=698558
https://nandynarwhals.org/CVE-2017-15587/

https://security.archlinux.org/CVE-2017-14685
https://security.archlinux.org/CVE-2017-14686
https://security.archlinux.org/CVE-2017-14687
https://security.archlinux.org/CVE-2017-15587