PT-2020-5812 · Artifex+1 · Mupdf+1

Published 2020-09-25 · Updated 2024-07-31 · CVE-2020-26519

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Artifex MuPDF versions prior to 1.18.0

Description: The issue is related to a heap-based buffer over-write when parsing JBIG2 files, allowing attackers to cause a denial of service. This can be exploited by a remote attacker to disrupt service.

Recommendations: For versions prior to 1.18.0, update to version 1.18.0 or later to resolve the issue. As a temporary workaround, consider avoiding the parsing of JBIG2 files until a patch is available. Restrict access to JBIG2 file parsing functionality to minimize the risk of exploitation.

Fix

DoS

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2020-3475

ALT-PU-2020-3484

ALT-PU-2024-9899

BDU:2021-01778

CVE-2020-26519

DLA-2589-1

DLA-2589-2

DSA-4794-1

Affected Products

Alt Linux

Mupdf

References · 23

• https://ubuntu.com/security/CVE-2020-26519 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-26519 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4794-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2589-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-26519 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26519 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-26519 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/WJMBKWVY7ZBIQV3EU5YHEFH5XWV4PABG · Vendor Advisory
• https://debian.org/security/2020/dsa-4794 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01778 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-26519 · Security Note
• https://osv.dev/vulnerability/DLA-2589-2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26519 · Vendor Advisory
• https://security.gentoo.org/glsa/202105-30 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SOF4PX2A5TGKKPMXINADSOJJ4H5UUMKK · Vendor Advisory