PT-2009-6296 · Artifex+1 · Mupdf+1

Christophe Devine

·

Publicado

2009-12-01

·

Atualizado

2024-09-16

·

CVE-2009-4117

CVSS v2.0

9.3

Alta

VetorAV:N/AC:M/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions MuPDF versions prior to commit 20091125231942 SumatraPDF versions prior to 1.0.1
Description The issue is related to multiple stack-based buffer overflows in the pdf shade4.c file. These overflows can be triggered by remote attackers via a /Decode array for certain types of shading that are not properly handled by the pdf loadtype4shade, pdf loadtype5shade, pdf loadtype6shade, and pdf loadtype7shade functions. This can cause a denial of service and possibly allow the execution of arbitrary code.
Recommendations For MuPDF versions prior to commit 20091125231942, update to a version after commit 20091125231942 to resolve the issue. For SumatraPDF versions prior to 1.0.1, update to version 1.0.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the pdf loadtype4shade, pdf loadtype5shade, pdf loadtype6shade, and pdf loadtype7shade functions until a patch is available.

Exploit

Correção

Buffer Overflow

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2009-4117

Produtos afetados

Mupdf
Sumatrapdf