PT-2018-13670 · Artifex+2 · Mupdf+2
Salvatore Bonaccorso
·
Publicado
2018-09-06
·
Atualizado
2025-10-16
·
CVE-2018-16648
CVSS v3.1
5.5
Média
| Vetor | AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Artifex MuPDF version 1.13.0
Description
The issue allows remote attackers to cause a denial of service, resulting in a segmentation fault, by providing a crafted pdf file. This is due to an array-index underflow in the pdf dev alpha array in pdf/pdf-device.c.
Recommendations
For Artifex MuPDF version 1.13.0, consider avoiding the use of the fz append byte function in fitz/buffer.c until a patch is available. As a temporary workaround, restrict the processing of crafted pdf files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.
Exploit
Correção
DoS
Improper Validation of Array Index
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Linuxmint
Mupdf