CVE-2016-6525

Name	CVE-2016-6525
Description	Heap-based buffer overflow in the pdf_load_mesh_params function in pdf/pdf-shade.c in MuPDF allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a large decode array.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
References	DLA-589-1, DSA-3655-1
NVD severity	high
Debian Bugs	833417

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mupdf (PTS)	jessie	1.5-1+deb8u4	fixed
	jessie (security)	1.5-1+deb8u6	fixed
	stretch (security), stretch	1.9a+ds1-4+deb9u4	fixed
	buster	1.14.0+ds1-4	fixed
	bullseye, sid	1.15.0+ds1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
mupdf	source	(unstable)	1.9a+ds1-1.2		833417
mupdf	source	jessie	1.5-1+deb8u1	DSA-3655-1
mupdf	source	wheezy	0.9-2+deb7u3	DLA-589-1

http://bugs.ghostscript.com/show_bug.cgi?id=696954
Fixed by: http://git.ghostscript.com/?p=mupdf.git;h=39b0f07dd960f34e7e6bf230ffc3d87c41ef0f2e