CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-15587
https://notcve.org/view.php?id=CVE-2017-15587
An integer overflow was discovered in pdf_read_new_xref_section in pdf/pdf-xref.c in Artifex MuPDF 1.11. Se ha descubierto un desbordamiento de enteros en pdf_read_new_xref_section en pdf/pdf-xref.c en Artifex MuPDF 1.11. • http://git.ghostscript.com/?p=mupdf.git%3Bh=82df2631d7d0446b206ea6b434ea609b6c28b0e8 http://www.debian.org/security/2017/dsa-4006 https://lists.debian.org/debian-lts-announce/2017/11/msg00007.html https://security.gentoo.org/glsa/201811-15 https://bugs.ghostscript.com/show_bug.cgi?id=698605 https://bugs.ghostscript.com/show_bug.cgi?id=698704 https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=d18bc728e46c5a5708f14d27c2b6c44e1d0c3232 • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-15369
https://notcve.org/view.php?id=CVE-2017-15369
The build_filter_chain function in pdf/pdf-stream.c in Artifex MuPDF before 2017-09-25 mishandles a certain case where a variable may reside in a register, which allows remote attackers to cause a denial of service (Fitz fz_drop_imp use-after-free and application crash) or possibly have unspecified other impact via a crafted PDF document. La función build_filter_chain en pdf/pdf-stream.c en Artifex MuPDF, en versiones anteriores al 2017-09-25, gestiona de manera incorrecta un caso específico en el que una variable podría encontrarse en un registro, lo que permite que atacantes remotos provoquen una denegación de servicio (uso de memoria después de su liberación o use-after-free de Fitz fz_drop_imp y cierre inesperado de la aplicación) o, probablemente, provocar otro tipo de impacto mediante un documento PDF manipulado. • http://git.ghostscript.com/?p=mupdf.git%3Bh=c2663e51238ec8256da7fc61ad580db891d9fe9a https://bugs.ghostscript.com/show_bug.cgi?id=698592 • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2017-14685
https://notcve.org/view.php?id=CVE-2017-14685
Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to "Data from Faulting Address controls Branch Selection starting at mupdf+0x000000000016aa61" on Windows. This occurs because xps_load_links_in_glyphs in xps/xps-link.c does not verify that an xps font could be loaded. La versión 1.11 de Artifex MuPDF permite que los atacantes provoquen una denegación de servicio o, posiblemente, otro impacto sin especificar mediante un archivo .xps manipulado. Esta vulnerabilidad está relacionada con "Data from Faulting Address controls Branch Selection starting at mupdf+0x000000000016aa61" en Windows. Esto ocurre porque xps_load_links_in_glyphs en xps/xps-link.c no verifica que se puede cargar una fuente xps. • http://git.ghostscript.com/?p=mupdf.git%3Bh=ab1a420613dec93c686acbee2c165274e922f82a http://www.debian.org/security/2017/dsa-4006 https://bugs.ghostscript.com/show_bug.cgi?id=698539 https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-14685 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2017-14687
https://notcve.org/view.php?id=CVE-2017-14687
Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to "Data from Faulting Address controls Branch Selection starting at mupdf+0x000000000016cb4f" on Windows. This occurs because of mishandling of XML tag name comparisons. La versión 1.11 de Artifex MuPDF permite que los atacantes provoquen una denegación de servicio o, posiblemente, otro impacto sin especificar mediante un archivo .xps manipulado. Esta vulnerabilidad está relacionada con "Data from Faulting Address controls Branch Selection starting at mupdf+0x000000000016cb4f" en Windows. Esto se debe a la gestión incorrecta de las comparaciones de nombres de etiquetas XML. • http://git.ghostscript.com/?p=mupdf.git%3Bh=2b16dbd8f73269cb15ca61ece75cf8d2d196ed28 http://www.debian.org/security/2017/dsa-4006 https://bugs.ghostscript.com/show_bug.cgi?id=698558 https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-14687 https://lists.debian.org/debian-lts-announce/2017/11/msg00007.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2017-14686
https://notcve.org/view.php?id=CVE-2017-14686
Artifex MuPDF 1.11 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to a "User Mode Write AV near NULL starting at wow64!Wow64NotifyDebugger+0x000000000000001d" on Windows. This occurs because read_zip_dir_imp in fitz/unzip.c does not check whether size fields in a ZIP entry are negative numbers. La versión 1.11 de Artifex MuPDF permite que los atacantes ejecuten código arbitrario o que provoquen una denegación de servicio mediante un archivo .xps manipulado, relacionado con "User Mode Write AV comenzando en wow64!Wow64NotifyDebugger+0x000000000000001d" en Windows. • http://git.ghostscript.com/?p=mupdf.git%3Bh=0f0fbc07d9be31f5e83ec5328d7311fdfd8328b1 http://www.debian.org/security/2017/dsa-4006 https://bugs.ghostscript.com/show_bug.cgi?id=698540 https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-14686 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •