Infinite Loop Vulnerability in MuPDF Package Leading to Denial of Service
Summary
ALPINE-CVE-2018-5686: In MuPDF 1.12.0, there is an infinite loop vulnerability and application hang in the pdf_parse_array function (pdf/pdf-parse.c) because EOF is not considered. Affects mupdf versions < 1.13-r0. Fixed in 1.13-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MuPDF is a lightweight PDF, XPS, and eBook viewer and toolkit designed for high-quality rendering of documents. It is widely used for its efficiency and speed in handling various document formats. However, the package has been identified to have a critical vulnerability that can lead to application hangs and denial of service when processing specially crafted PDF files.
Vulnerability Detail
In MuPDF version 1.12.0, an infinite loop vulnerability exists in the pdf_parse_array function located in pdf/pdf-parse.c. This vulnerability arises because the end of file (EOF) condition is not properly handled, allowing remote attackers to exploit this flaw by sending a crafted PDF file. The ramifications include potential denial of service, where the application may become unresponsive, impacting users and services relying on the PDF processing capabilities of MuPDF.
How To Fix
Minimum fixed version
1.13-r0
This is the first release that contains the fix.
sudo apk add --upgrade mupdfTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid opening untrusted or unknown PDF files until the package is updated. Implementing strict input validation on PDF files can also help mitigate the risk of exploitation.
Conclusion
The infinite loop vulnerability in MuPDF poses a significant risk of denial of service due to improper handling of EOF conditions in PDF files. It is crucial for users to update to the patched version 1.13-r0 to safeguard against potential exploits. Additionally, employing workarounds can help mitigate risks until updates are applied.
See every vulnerability recorded for mupdf →
FAQ
The vulnerability affects MuPDF versions prior to 1.13-r0 across multiple Alpine versions including v3.7, v3.8, v3.9, v3.10, and v3.11.
The CVSS score for this vulnerability is 5.5, indicating a moderate level of severity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By utilizing the Vulert playground, you can check if your application is affected without needing to sign up.
The primary impact is denial of service, where the application may hang indefinitely when processing malicious PDF files, disrupting normal operations.
Yes, avoid opening untrusted PDF files and implement strict input validation to reduce the risk of exploitation until the patch is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for mupdf.
