PT-2019-17969 · Artifex · Artifex Mupdf

Zerokeeper · Published 2019-01-11 · Updated 2024-09-11 · CVE-2019-6131

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Artifex MuPDF version 1.14.0

Description The issue is related to infinite recursion with stack consumption in the svg run use symbol, svg run element, and svg run use functions in the svg-run.c file. This can be demonstrated using mutool.

Recommendations For Artifex MuPDF version 1.14.0, consider disabling the svg run use symbol, svg run element, and svg run use functions as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2019-6131

Affected Products

Artifex Mupdf

References · 14

• 🔥 https://bugs.ghostscript.com/show_bug.cgi?id=700442 · Exploit
• https://ubuntu.com/security/CVE-2019-6131 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-6131 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNJNEX5EW6YH5OARXXSSXW4HHC5PIBSY · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-6131 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-6131 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SEK2EHVNREJ7XZMFF2MXRWKIF4IBHPNE · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-6131 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-6131 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6131 · Security Note
• http://ghostscript.com/cgi-bin/findgit.cgi?c8f7e48ff74720a5e984ae19d978a5ab4d5dde5b · Note
• https://t.me/cvenotify/94220 · Telegram Post
• http://securityfocus.com/bid/106558 · Note
• https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=c8f7e48ff74720a5e984ae19d978a5ab4d5dde5b · Note