CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2019-7321
https://notcve.org/view.php?id=CVE-2019-7321
Usage of an uninitialized variable in the function fz_load_jpeg in Artifex MuPDF 1.14 can result in a heap overflow vulnerability that allows an attacker to execute arbitrary code. El uso de una variable sin inicializar en la función fz_load_jpeg en Artifex MuPDF 1.14 puede dar como resultado una vulnerabilidad de desbordamiento de pila (heap) que permite a un atacante ejecutar código arbitrario. • https://bugs.ghostscript.com/show_bug.cgi?id=700560 https://github.com/ereisr00/bagofbugz/tree/master/MuPDF/700560 https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=2be83b57e77938fddbb06bdffb11979ad89a9c7d • CWE-787: Out-of-bounds Write CWE-908: Use of Uninitialized Resource •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-6130
https://notcve.org/view.php?id=CVE-2019-6130
Artifex MuPDF 1.14.0 has a SEGV in the function fz_load_page of the fitz/document.c file, as demonstrated by mutool. This is related to page-number mishandling in cbz/mucbz.c, cbz/muimg.c, and svg/svg-doc.c. Artifex MuPDF 1.14.0 tiene un SEGV en la función fz_load_page del archivo fitz/document.c, tal y como queda demostrado con mutool. Esto está relacionado con la mala gestión de página-número en cbz/mucbz.c, cbz/muimg.c y svg/svg-doc.c. • http://www.securityfocus.com/bid/106558 https://bugs.ghostscript.com/show_bug.cgi?id=700446 https://lists.debian.org/debian-lts-announce/2019/06/msg00027.html https://lists.debian.org/debian-lts-announce/2020/07/msg00019.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNJNEX5EW6YH5OARXXSSXW4HHC5PIBSY https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SEK2EHVNREJ7XZMFF2MXRWKIF4IBHPNE https://cgit.ghostscript.com/cgi-bin/cgit. • CWE-118: Incorrect Access of Indexable Resource ('Range Error') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-6131
https://notcve.org/view.php?id=CVE-2019-6131
svg-run.c in Artifex MuPDF 1.14.0 has infinite recursion with stack consumption in svg_run_use_symbol, svg_run_element, and svg_run_use, as demonstrated by mutool. svg-run.c en Artifex MuPDF 1.14.0 tiene una recursión infinita con consumo de pila en svg_run_use_symbol, svg_run_element y svg_run_use, tal y como queda demostrado con mutool. • http://www.securityfocus.com/bid/106558 https://bugs.ghostscript.com/show_bug.cgi?id=700442 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNJNEX5EW6YH5OARXXSSXW4HHC5PIBSY https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SEK2EHVNREJ7XZMFF2MXRWKIF4IBHPNE https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=c8f7e48ff74720a5e984ae19d978a5ab4d5dde5b • CWE-674: Uncontrolled Recursion •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2018-19881
https://notcve.org/view.php?id=CVE-2018-19881
In Artifex MuPDF 1.14.0, svg/svg-run.c allows remote attackers to cause a denial of service (recursive calls followed by a fitz/xml.c fz_xml_att crash from excessive stack consumption) via a crafted svg file, as demonstrated by mupdf-gl. En Artifex MuPDF 1.14.0, svg/svg-run.c permite que atacantes remotos provoquen una denegación de servicio (llamadas recursivas seguidas por un cierre inesperado de fz_xml_att en fitz/xml.c debido al consumo excesivo de pila) mediante un archivo svg manipulado, tal y como queda demostrado por mupdf-gl. • https://bugs.ghostscript.com/show_bug.cgi?id=700342 https://github.com/TeamSeri0us/pocs/tree/master/mupdf/20181203 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNJNEX5EW6YH5OARXXSSXW4HHC5PIBSY https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SEK2EHVNREJ7XZMFF2MXRWKIF4IBHPNE https://bugs.ghostscript.com/show_bug.cgi?id=700442 https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=c8f7e48ff74720a5e984ae19d978a5ab4d5dde5b • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2018-19882
https://notcve.org/view.php?id=CVE-2018-19882
In Artifex MuPDF 1.14.0, the svg_run_image function in svg/svg-run.c allows remote attackers to cause a denial of service (href_att NULL pointer dereference and application crash) via a crafted svg file, as demonstrated by mupdf-gl. En Artifex MuPDF 1.14.0, la función svg_run_image en svg/svg-run.c permite que atacantes remotos provoquen una denegación de servicio (desreferencia de puntero NULL de href_att y cierre inesperado de la aplicación) mediante un archivo svg manipulado, tal y como queda demostrado con mupdf-gl. • https://bugs.ghostscript.com/show_bug.cgi?id=700342 https://github.com/TeamSeri0us/pocs/tree/master/mupdf/20181203 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNJNEX5EW6YH5OARXXSSXW4HHC5PIBSY https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SEK2EHVNREJ7XZMFF2MXRWKIF4IBHPNE http://www.ghostscript.com/cgi-bin/findgit.cgi?a7f7d91cdff8d303c11d458fa8b802776f73c8cc • CWE-476: NULL Pointer Dereference •