ArchLinux: 201805-12: zathura-pdf-mupdf: multiple issues
Summary
- CVE-2018-5686 (denial of service)
In MuPDF 1.12.0, there is an infinite loop vulnerability and
application hang in the pdf_parse_array function (pdf/pdf-parse.c)
because EOF is not considered. Remote attackers could leverage this
vulnerability to cause a denial of service via a crafted pdf file.
- CVE-2018-6187 (denial of service)
In Artifex MuPDF 1.12.0, there is a heap-based buffer overflow
vulnerability in the do_pdf_save_document function in the pdf/pdf-
write.c file. Remote attackers could leverage the vulnerability to
cause a denial of service via a crafted pdf file.
- CVE-2018-6192 (denial of service)
In Artifex MuPDF 1.12.0, the pdf_read_new_xref function in pdf/pdf-
xref.c allows remote attackers to cause a denial of service
(segmentation violation and application crash) via a crafted pdf file.
- CVE-2018-6544 (denial of service)
pdf_load_obj_stm in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 could
reference the object stream recursively and therefore run out of error
stack, which allows remote attackers to cause a denial of service via a
crafted PDF document.
- CVE-2018-1000051 (arbitrary code execution)
Artifex Mupdf version 1.12.0 contains a use-after-free vulnerability in
fz_keep_key_storable that can result in DOS / Possible code execution.
This attack appear to be exploitable via Victim opens a specially
crafted PDF.
Resolution
Upgrade to 0.3.3-3.
# pacman -Syu "zathura-pdf-mupdf>=0.3.3-3"
The problems have been fixed upstream but no release is available yet.
References
https://bugs.archlinux.org/task/57486 https://bugs.ghostscript.com/show_bug.cgi?id=698860 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=b70eb93f6936c03d8af52040bbca4d4a7db39079 https://bugs.ghostscript.com/show_bug.cgi?id=698908 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=3e30fbb7bf5efd88df431e366492356e7eb969ec https://bugs.ghostscript.com/show_bug.cgi?id=698916 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=5e411a99604ff6be5db9e273ee84737204113299 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=fa9cd085533f68367c299e058ab3fbb7ad8a2dc6 https://bugs.ghostscript.com/show_bug.cgi?id=698965 https://bugs.ghostscript.com/show_bug.cgi?id=698830 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=b03def134988da8c800adac1a38a41a1f09a1d89 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=26527eef77b3e51c2258c8e40845bfbc015e405d https://bugs.ghostscript.com/show_bug.cgi?id=698825 https://bugs.ghostscript.com/show_bug.cgi?id=698873 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=321ba1de287016b0036bf4a56ce774ad11763384 https://security.archlinux.org/CVE-2018-5686 https://security.archlinux.org/CVE-2018-6187 https://security.archlinux.org/CVE-2018-6192 https://security.archlinux.org/CVE-2018-6544 https://security.archlinux.org/CVE-2018-1000051
Workaround
None.