Arch Linux Security Advisory ASA-201805-7
========================================
Severity: High
Date    : 2018-05-10
CVE-ID  : CVE-2018-5686 CVE-2018-6187 CVE-2018-6192 CVE-2018-6544
          CVE-2018-1000051
Package : mupdf-tools
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-688

Summary
======
The package mupdf-tools before version 1.13.0-1 is vulnerable to
multiple issues including arbitrary code execution and denial of
service.

Resolution
=========
Upgrade to 1.13.0-1.

# pacman -Syu "mupdf-tools>=1.13.0-1"

The problems have been fixed upstream in version 1.13.0.

Workaround
=========
None.

Description
==========
- CVE-2018-5686 (denial of service)

In MuPDF 1.12.0, there is an infinite loop vulnerability and
application hang in the pdf_parse_array function (pdf/pdf-parse.c)
because EOF is not considered. Remote attackers could leverage this
vulnerability to cause a denial of service via a crafted pdf file.

- CVE-2018-6187 (denial of service)

In Artifex MuPDF 1.12.0, there is a heap-based buffer overflow
vulnerability in the do_pdf_save_document function in the pdf/pdf-
write.c file. Remote attackers could leverage the vulnerability to
cause a denial of service via a crafted pdf file.

- CVE-2018-6192 (denial of service)

In Artifex MuPDF 1.12.0, the pdf_read_new_xref function in pdf/pdf-
xref.c allows remote attackers to cause a denial of service
(segmentation violation and application crash) via a crafted pdf file.

- CVE-2018-6544 (denial of service)

pdf_load_obj_stm in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 could
reference the object stream recursively and therefore run out of error
stack, which allows remote attackers to cause a denial of service via a
crafted PDF document.

- CVE-2018-1000051 (arbitrary code execution)

Artifex Mupdf version 1.12.0 contains a Use After Free vulnerability in
fz_keep_key_storable that can result in DOS / Possible code execution.
This attack appear to be exploitable via Victim opens a specially
crafted PDF.

Impact
=====
A remote attacker is able to crash the application or execute arbitrary
code via a specially crafted PDF file.

References
=========
https://bugs.archlinux.org/task/57486
https://bugs.ghostscript.com/show_bug.cgi?id=698860
https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=b70eb93f6936c03d8af52040bbca4d4a7db39079
https://bugs.ghostscript.com/show_bug.cgi?id=698908
https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=3e30fbb7bf5efd88df431e366492356e7eb969ec
https://bugs.ghostscript.com/show_bug.cgi?id=698916
https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=5e411a99604ff6be5db9e273ee84737204113299
https://git.ghostscript.com/?p=mupdf.git;h=fa9cd085533f68367c299e058ab3fbb7ad8a2dc6
https://bugs.ghostscript.com/show_bug.cgi?id=698965
https://bugs.ghostscript.com/show_bug.cgi?id=698830
https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=b03def134988da8c800adac1a38a41a1f09a1d89
https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=26527eef77b3e51c2258c8e40845bfbc015e405d
https://bugs.ghostscript.com/show_bug.cgi?id=698825
https://bugs.ghostscript.com/show_bug.cgi?id=698873
https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=321ba1de287016b0036bf4a56ce774ad11763384
https://security.archlinux.org/CVE-2018-5686
https://security.archlinux.org/CVE-2018-6187
https://security.archlinux.org/CVE-2018-6192
https://security.archlinux.org/CVE-2018-6544
https://security.archlinux.org/CVE-2018-1000051