Use-after-free vulnerability in the pdf_load_xref function in pdf/pdf-xref.c in MuPDF allows remote attackers to cause a denial of service (crash) via a crafted PDF file.

Security fix for CVE-2016-6265

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New release (1.10a). Security fix for CVE-2016-6265

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201702-12 (MuPDF: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MuPDF. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted PDF       document using MuPDF possibly resulting in the execution of arbitrary       code, with the privileges of the process, or a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

Tobias Kortkamp reports :

Heap-based buffer overflow in the pdf_load_mesh_params function in pdf/pdf-shade.c in MuPDF allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a large decode array.

Use-after-free vulnerability in the pdf_load_xref function in pdf/pdf-xref.c in MuPDF allows remote attackers to cause a denial of service (crash) via a crafted PDF file.

Two vulnerabilities were discovered in MuPDF, a lightweight PDF viewer. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2016-6265     Marco Grassi discovered a use-after-free vulnerability     in MuPDF. An attacker can take advantage of this flaw to     cause an application crash (denial-of-service), or     potentially to execute arbitrary code with the     privileges of the user running MuPDF, if a specially     crafted PDF file is processed.

  - CVE-2016-6525     Yu Hong and Zheng Jihong discovered a heap overflow     vulnerability within the pdf_load_mesh_params function,     allowing an attacker to cause an application crash     (denial-of-service), or potentially to execute arbitrary     code with the privileges of the user running MuPDF, if a     specially crafted PDF file is processed.

This update for mupdf fixes the following issues :

Security issues fixed :

  - CVE-2016-6265: Fixed a use-after-free issue     (boo#990195).

ID	Name	Product	Family	Severity
97482	Fedora 24 : mupdf (2017-844445f2aa)	Nessus	Fedora Local Security Checks	medium
97453	Fedora 25 : mupdf (2017-6fe982684d)	Nessus	Fedora Local Security Checks	medium
97255	GLSA-201702-12 : MuPDF: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
93985	FreeBSD : mupdf -- multiple vulnerabilities (47157c14-9013-11e6-a590-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	critical
93134	Debian DSA-3655-1 : mupdf - security update	Nessus	Debian Local Security Checks	critical
92715	openSUSE Security Update : mupdf (openSUSE-2016-926)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2016-6265

medium

Tenable Plugins

medium

medium

critical

critical

critical

medium