MuPDF vulnerabilities

A stack-based buffer overflow in jstest_main.c in mujstest in Artifex Software, Inc. MuPDF 1.10a allows remote attackers to have unspecified impact via a crafted image.

An issue was discovered in MuPDF before version 1912de5f08e90af1d9d0a9791f58ba3afdb9d465 related to a NULL pointer dereference in the pdf_run_xobject function during a Fitz fz_paint_pixmap_with_mask painting operation.

A heap-based buffer overflow in the pdf_load_mesh_params function in MuPDF can be exploited by remote attackers. Exploiting this vulnerability may lead to denial of service or arbitrary code execution via a large decode array.

A vulnerability in MuPDF before version 1.27.0-rc1 allows a DoS attack via a specially crafted EPUB file with deeply nested HTML elements and inline CSS styles. The function value_from_inheritable_property() in css-apply.c recursively processes the CSS inheritance chain without a depth limit, exhausting the stack and causing a crash.

A double-free vulnerability in MuPDF versions 1.23.0 through 1.27.0 exists in the fz_fill_pixmap_from_display_list() function during error handling. The function incorrectly drops a caller-owned fz_pixmap pointer in its error path before rethrowing the exception, leading to a double-free that can corrupt the heap and crash the process.

An infinite recursion vulnerability was found in Artifex MuPDF versions 1.25.5 and 1.25.6 within the `mutool clean` utility. A remote attacker can cause a denial of service (DoS) by supplying a crafted PDF file with cyclic /Next references in the outline structure.