CVE-2017-15369
HighSummary
The build_filter_chain function in pdf/pdf-stream.c in Artifex MuPDF before September 25, 2017, mishandles a case where a variable may reside in a register. This allows remote attackers to cause a denial of service or possibly other unspecified impacts via a crafted PDF document.
Risk Assessment
The organization may be exposed to attacks leading to denial of service and application crashes, affecting the availability of services related to PDF document processing.
Recommendation
It is recommended to update to the latest version of Artifex MuPDF to mitigate this vulnerability and to monitor systems for suspicious activity related to PDF documents.
Other vulnerabilities in Artifex MuPDF
See all- CVE-2017-17866High
Artifex MuPDF before version 1.12.0 mishandles certain length changes during a repair operation in pdf/pdf-write.c, which can lead to buffer overflow and application crash.
- CVE-2017-15587High
An integer overflow was discovered in pdf_read_new_xref_section in Artifex MuPDF 1.11.
- CVE-2017-14687High
Artifex MuPDF version 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. The issue arises from mishandling of XML tag name comparisons.
- CVE-2017-14686High
Artifex MuPDF version 1.11 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file. The issue arises from the lack of checks for negative size fields in a ZIP entry.
- CVE-2017-14685High
Artifex MuPDF version 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. The issue is related to the xps_load_links_in_glyphs function, which does not verify that an xps font could be loaded.
Original NVD description (English source)
The build_filter_chain function in pdf/pdf-stream.c in Artifex MuPDF before 2017-09-25 mishandles a certain case where a variable may reside in a register, which allows remote attackers to cause a denial of service (Fitz fz_drop_imp use-after-free and application crash) or possibly have unspecified other impact via a crafted PDF document.