Arch Linux Security Advisory ASA-201805-8
========================================
Severity: High
Date    : 2018-05-10
CVE-ID  : CVE-2018-5686 CVE-2018-6187 CVE-2018-6192 CVE-2018-6544
          CVE-2018-1000051
Package : llpp
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-690

Summary
======
The package llpp before version 27-2 is vulnerable to multiple issues
including arbitrary code execution and denial of service.

Resolution
=========
Upgrade to 27-2.

# pacman -Syu "llpp>=27-2"

The problems have been fixed upstream but no release is available yet.

Workaround
=========
None.

Description
==========
- CVE-2018-5686 (denial of service)

In MuPDF 1.12.0, there is an infinite loop vulnerability and
application hang in the pdf_parse_array function (pdf/pdf-parse.c)
because EOF is not considered. Remote attackers could leverage this
vulnerability to cause a denial of service via a crafted pdf file.

- CVE-2018-6187 (denial of service)

In Artifex MuPDF 1.12.0, there is a heap-based buffer overflow
vulnerability in the do_pdf_save_document function in the pdf/pdf-write.c file. Remote attackers could leverage the vulnerability to
cause a denial of service via a crafted pdf file.

- CVE-2018-6192 (denial of service)

In Artifex MuPDF 1.12.0, the pdf_read_new_xref function in pdf/pdf-xref.c allows remote attackers to cause a denial of service
(segmentation violation and application crash) via a crafted pdf file.

- CVE-2018-6544 (denial of service)

pdf_load_obj_stm in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 could
reference the object stream recursively and therefore run out of error
stack, which allows remote attackers to cause a denial of service via a
crafted PDF document.

- CVE-2018-1000051 (arbitrary code execution)

Artifex Mupdf version 1.12.0 contains a use-after-free vulnerability in
fz_keep_key_storable that can result in DOS / Possible code execution.
This attack appear to be exploitable via Victim opens a specially
crafted PDF.

Impact
=====
A remote attacker is able to crash the application or execute arbitrary
code via a specially crafted PDF file.

References
=========
https://bugs.archlinux.org/task/57486
https://bugs.ghostscript.com/show_bug.cgi?id=698860
https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=b70eb93f6936c03d8af52040bbca4d4a7db39079
https://bugs.ghostscript.com/show_bug.cgi?id=698908
https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=3e30fbb7bf5efd88df431e366492356e7eb969ec
https://bugs.ghostscript.com/show_bug.cgi?id=698916
https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=5e411a99604ff6be5db9e273ee84737204113299
https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=fa9cd085533f68367c299e058ab3fbb7ad8a2dc6
https://bugs.ghostscript.com/show_bug.cgi?id=698965
https://bugs.ghostscript.com/show_bug.cgi?id=698830
https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=b03def134988da8c800adac1a38a41a1f09a1d89
https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=26527eef77b3e51c2258c8e40845bfbc015e405d
https://bugs.ghostscript.com/show_bug.cgi?id=698825
https://bugs.ghostscript.com/show_bug.cgi?id=698873
https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=321ba1de287016b0036bf4a56ce774ad11763384
https://security.archlinux.org/CVE-2018-5686
https://security.archlinux.org/CVE-2018-6187
https://security.archlinux.org/CVE-2018-6192
https://security.archlinux.org/CVE-2018-6544
https://security.archlinux.org/CVE-2018-1000051