PT-2017-16811 · Artifex+1 · Mupdf+1

Kamil Frankowicz · Published 2017-02-15 · Updated 2024-07-31 · CVE-2017-5991

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Artifex MuPDF versions prior to 1912de5f08e90af1d9d0a9791f58ba3afdb9d465 Artifex MuPDF versions prior to 1.11

Description An issue was discovered in the pdf run xobject function in pdf-op-run.c, which encounters a NULL pointer dereference during a Fitz fz paint pixmap with mask painting operation.

Recommendations For versions prior to 1912de5f08e90af1d9d0a9791f58ba3afdb9d465, consider updating to a version that includes the fix for this issue. For versions prior to 1.11, consider updating to version 1.11 or later, as these versions are unaffected by this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability, other than updating to version 1.11 or later.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2018-2415

ALT-PU-2020-3475

ALT-PU-2020-3484

ALT-PU-2024-9899

CVE-2017-5991

DSA-3797-1

MGASA-2017-0479

Affected Products

Alt Linux

Mupdf

References · 77

• 🔥 https://bugs.ghostscript.com/show_bug.cgi?id=697500 · Exploit
• 🔥 https://exploit-db.com/exploits/42138 · Exploit
• https://osv.dev/vulnerability/DSA-3797-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2017-5991 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2020-3484 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000039 · Security Note
• https://errata.altlinux.org/ALT-PU-2018-2415 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6525 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14975 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6265 · Security Note
• https://debian.org/security/2017/dsa-4006 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01673 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10246 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5991 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17866 · Security Note