Stack-based buffer overflow in jstest_main.c in mujstest in Artifex Software, Inc. MuPDF 1.10a allows remote attackers to have unspecified impact via a crafted image.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2765 advisory.

  - Buffer overflow in the main function in jstest_main.c in Mujstest in Artifex Software, Inc. MuPDF before     1.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file.
    (CVE-2016-10246)

  - Buffer overflow in the my_getline function in jstest_main.c in Mujstest in Artifex Software, Inc. MuPDF     before 1.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file.
    (CVE-2016-10247)

  - Stack-based buffer overflow in jstest_main.c in mujstest in Artifex Software, Inc. MuPDF 1.10a allows     remote attackers to have unspecified impact via a crafted image. (CVE-2017-6060)

  - In MuPDF 1.12.0 and earlier, multiple memory leaks in the PDF parser allow an attacker to cause a denial     of service (memory leak) via a crafted file. (CVE-2018-1000036)

  - In MuPDF 1.13.0, there is an infinite loop in the fz_skip_space function of the pdf/pdf-xref.c file. A     remote adversary could leverage this vulnerability to cause a denial of service via a crafted pdf file.
    (CVE-2018-10289)

  - Artifex MuPDF before 1.18.0 has a heap based buffer over-write in tiff_expand_colormap() function when     parsing TIFF files allowing attackers to cause a denial of service. (CVE-2020-19609)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

fix buffer overflow (#1425338)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201706-08 (MuPDF: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MuPDF. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to process a specially crafted PDF       document or image using MuPDF, possibly resulting in a Denial of Service       condition or have other unspecified impact.
  Workaround :

    There is no known workaround at this time.

Security fix for CVE-2017-5896 CVE-2017-6060

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2017-6060 CVE-2017-5896

----

Add comment with explanation of disabled debuginfo

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
153600	Debian DLA-2765-1 : mupdf - LTS security update	Nessus	Debian Local Security Checks	high
101622	Fedora 26 : mupdf (2017-487051ac16)	Nessus	Fedora Local Security Checks	high
100651	GLSA-201706-08 : MuPDF: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
97925	Fedora 24 : mupdf (2017-3b97b275da)	Nessus	Fedora Local Security Checks	critical
97591	Fedora 25 : mupdf (2017-9a819664a6)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2017-6060

high

Tenable Plugins

high

high

high

critical

critical