CVE-2017-14687
HighSummary
Artifex MuPDF version 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. The issue arises from mishandling of XML tag name comparisons.
Risk Assessment
The organization may experience service outages related to MuPDF, potentially leading to loss of user trust and financial losses.
Recommendation
It is recommended to update MuPDF to the latest version to mitigate the risks associated with this vulnerability.
Other vulnerabilities in Artifex MuPDF 1.11
See all- CVE-2017-17866High
Artifex MuPDF before version 1.12.0 mishandles certain length changes during a repair operation in pdf/pdf-write.c, which can lead to buffer overflow and application crash.
- CVE-2017-15587High
An integer overflow was discovered in pdf_read_new_xref_section in Artifex MuPDF 1.11.
- CVE-2017-15369High
The build_filter_chain function in pdf/pdf-stream.c in Artifex MuPDF before September 25, 2017, mishandles a case where a variable may reside in a register. This allows remote attackers to cause a denial of service or possibly other unspecified impacts via a crafted PDF document.
- CVE-2017-14686High
Artifex MuPDF version 1.11 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file. The issue arises from the lack of checks for negative size fields in a ZIP entry.
- CVE-2017-14685High
Artifex MuPDF version 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. The issue is related to the xps_load_links_in_glyphs function, which does not verify that an xps font could be loaded.
Original NVD description (English source)
Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to "Data from Faulting Address controls Branch Selection starting at mupdf+0x000000000016cb4f" on Windows. This occurs because of mishandling of XML tag name comparisons.