PT-2019-2663 · Artifex · Artifex Mupdf

Toorto · Published 2019-01-01 · Updated 2020-08-30 · CVE-2019-13290

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Artifex MuPDF version 1.15.0

Description The issue is a heap-based buffer overflow in the fz append display node function, located at fitz/list-device.c, which allows remote attackers to execute arbitrary code via a crafted PDF file. This occurs when a large BDC property name overflows the allocated size of a display list node.

Recommendations For Artifex MuPDF version 1.15.0, consider disabling the fz append display node function until a patch is available to prevent exploitation. Avoid using the affected function to process crafted PDF files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

BDU:2019-02549

CVE-2019-13290

DLA-2289-1

DSA-4753-1

Affected Products

Artifex Mupdf

References · 36

• 🔥 https://github.com/TeamSeri0us/pocs/tree/master/mupdf · Exploit
• 🔥 https://archive.today/oi6bm · Exploit
• https://bdu.fstec.ru/vul/2019-02549 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-13290 · Security Note
• https://security-tracker.debian.org/tracker/DLA-2289-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-4753-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/mupdf · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13290 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-13290 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18662 · Security Note
• https://osv.dev/vulnerability/DSA-4753-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-13290 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6130 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUXKCY35PKC32IFHN4RBUCZ75OWEYVJH · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2289-1 · Vendor Advisory