CVE-2017-17858

NameCVE-2017-17858
DescriptionHeap-based buffer overflow in the ensure_solid_xref function in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 allows a remote attacker to potentially execute arbitrary code via a crafted PDF file, because xref subsection object numbers are unrestricted.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
mupdf (PTS)jessie1.5-1+deb8u4fixed
jessie (security)1.5-1+deb8u6fixed
stretch (security), stretch1.9a+ds1-4+deb9u4fixed
buster1.14.0+ds1-4fixed
bullseye, sid1.16.1+ds1-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
mupdfsource(unstable)(not affected)

Notes

- mupdf <not-affected> (Vulnerable code introduced in 1.11.1)
https://bugs.ghostscript.com/show_bug.cgi?id=698819 (not public)
Fixed by: http://git.ghostscript.com/?p=mupdf.git;a=commit;h=55c3f68d638ac1263a386e0aaa004bb6e8bde731
Commit http://git.ghostscript.com/?p=mupdf.git;a=commit;h=f595e889b91a674eb94db7ca4d832da54f5194cd
switches to use int64_t for public file API offsets and introduced the flaw.
https://github.com/mzet-/Security-Advisories/blob/master/mzet-adv-2017-01.md

Search for package or bug name: Reporting problems