Heap-based buffer overflow in the js_stackoverflow function in jsrun.c in Artifex Software, Inc. MuJS allows attackers to have unspecified impact by leveraging an error when dropping extra arguments to lightweight functions.

Security fix for CVE-2016-10132, CVE-2016-10133, CVE-2016-10141, CVE-2017-5627, CVE-2017-5628.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for mupdf to version 1.10a fixes the following issues :

These security issues were fixed :

  - CVE-2016-10132: NULL pointer dereference in regexp     because of a missing check after allocating memory     allowing for DoS (bsc#1019877).

  - CVE-2016-10133: Heap buffer overflow write in     js_stackoverflow allowing for DoS or possible code     execution (bsc#1019877).

  - CVE-2016-10141: An integer overflow vulnerability     triggered by a regular expression with nested     repetition. A successful exploitation of this issue can     lead to code execution or a denial of service (buffer     overflow) condition (bsc#1019877).

These non-security issues were fixed :

  - A bug with mutool and saving PDF files using the 'ascii'     option has been fixed.

  - Stop defining OPJ_STATIC

  - FictionBook (FB2) e-book support.

  - Simple SVG parser (a small subset of SVG only).

  - mutool convert: a new document conversion tool and     interface.

  - Multi-threaded rendering in mudraw.

  - Updated base 14 fonts from URW.

  - New CJK font with language specific variants.

  - Hyperlink support in EPUB.

  - Alpha channel is now optional in pixmaps.

  - More aggressive purging of cached objects.

  - Partial image decoding for lower memory use when     banding.

  - Reduced default set of built-in CMap tables to the     minimum required.

  - FZ_ENABLE_PDF, _XPS, _JS, to disable features at compile     time.

  - Function level linking.

  - Dropped pdf object generation numbers from public     interfaces.

  - Simplified PDF page, xobject, and annotation internals.

  - Closing and freeing devices and writers are now separate     steps.

  - Improved PDF annotation editing interface (still a work     in progress).

  - Document writer interface.

  - Banded image writer interface.

  - Bidirectional layout for Arabic and Hebrew scripts.

  - Shaping complex scripts for EPUB text layout.

  - Noto fallback fonts for EPUB layout.

  - mutool create :

  - Create new PDF files from scratch.

  - Read an annotated content stream in a text file and     write a PDF file, automatically embedding font and image     resources.

  - mutool run :

  + Run JavaScript scripts with MuPDF bindings.

  + The interface is similar to the new Java interface.

  - mutool draw :

  + Optional multi-threaded operation (Windows and     pthreads).

  + Optional low memory mode (primarily for testing).

  - Set to best anti-alias mode (8) by default. 

  - Ship mupdf-x11-curl as default mupdf. Drop non-curl     version.

  - New URW fonts with greek and cyrillic.

  - 64-bit file support.

  - Updated FreeType to version 2.6.1.

  - Various font substitution bug fixes.

  - EPUB improvements: User style sheets, GIF images, Table     of Contents, CJK text, Page margins and many bug fixes.

This update for mupdf to version 1.10a fixes the following issues :

These security issues were fixed :

  - CVE-2016-10132: NULL pointer dereference in regexp     because of a missing check after allocating memory     allowing for DoS (bsc#1019877).

  - CVE-2016-10133: Heap buffer overflow write in     js_stackoverflow allowing for DoS or possible code     execution (bsc#1019877).

  - CVE-2016-10141: An integer overflow vulnerability     triggered by a regular expression with nested     repetition. A successful exploitation of this issue can     lead to code execution or a denial of service (buffer     overflow) condition (bsc#1019877).

These non-security issues were fixed :

  - A bug with mutool and saving PDF files using the 'ascii'     option has been fixed.

  - Stop defining OPJ_STATIC

ID	Name	Product	Family	Severity
97341	Fedora 25 : mujs (2017-dc6023e849)	Nessus	Fedora Local Security Checks	critical
97338	Fedora 24 : mujs (2017-624e2eeda0)	Nessus	Fedora Local Security Checks	critical
97000	openSUSE Security Update : mupdf (openSUSE-2017-197)	Nessus	SuSE Local Security Checks	critical
96999	openSUSE Security Update : mupdf (openSUSE-2017-196)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2016-10133

critical

Tenable Plugins

critical

critical

critical

critical