CVE-2017-15587
HighSummary
An integer overflow was discovered in pdf_read_new_xref_section in Artifex MuPDF 1.11.
Risk Assessment
The integer overflow may lead to unexpected application behavior, posing a risk of potential code execution.
Recommendation
It is recommended to update to the latest version of MuPDF to mitigate this vulnerability.
Other vulnerabilities in Artifex MuPDF 1.11
See all- CVE-2017-17866High
Artifex MuPDF before version 1.12.0 mishandles certain length changes during a repair operation in pdf/pdf-write.c, which can lead to buffer overflow and application crash.
- CVE-2017-15369High
The build_filter_chain function in pdf/pdf-stream.c in Artifex MuPDF before September 25, 2017, mishandles a case where a variable may reside in a register. This allows remote attackers to cause a denial of service or possibly other unspecified impacts via a crafted PDF document.
- CVE-2017-14687High
Artifex MuPDF version 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. The issue arises from mishandling of XML tag name comparisons.
- CVE-2017-14686High
Artifex MuPDF version 1.11 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file. The issue arises from the lack of checks for negative size fields in a ZIP entry.
- CVE-2017-14685High
Artifex MuPDF version 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. The issue is related to the xps_load_links_in_glyphs function, which does not verify that an xps font could be loaded.
Original NVD description (English source)
An integer overflow was discovered in pdf_read_new_xref_section in pdf/pdf-xref.c in Artifex MuPDF 1.11.