Segmentation Fault Vulnerability in mupdf Package Leading to Denial of Service
Summary
DEBIAN-CVE-2024-46657: Artifex Software mupdf v1.24.9 was discovered to contain a segmentation fault via the component /tools/pdfextract.c. Affects mupdf versions < 1.25.1+ds1-5. Fixed in 1.25.1+ds1-5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mupdf package is a lightweight PDF, XPS, and eBook viewer that is designed for high-quality rendering and fast performance. It is widely used in various applications due to its efficiency and ability to handle complex documents. However, the package has been found to have a vulnerability that can be exploited through specially crafted PDF files, leading to potential service disruptions.
Vulnerability Detail
Artifex Software mupdf version 1.24.9 contains a vulnerability that results in a segmentation fault when processing certain PDF files. This issue is located in the component /tools/pdfextract.c. Attackers can exploit this vulnerability to cause a Denial of Service (DoS), rendering the application unusable until it is restarted. The vulnerability arises from improper handling of input data, which can lead to unexpected behavior and crashes.
How To Fix
Minimum fixed version
1.25.1+ds1-5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade mupdfTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid opening untrusted PDF files that may exploit this vulnerability until the package is updated. Additionally, running mupdf in a controlled environment or sandbox can help mitigate the risk of exploitation.
Conclusion
The segmentation fault vulnerability in the mupdf package poses a significant risk by allowing attackers to cause Denial of Service through crafted PDF files. Users are strongly advised to update to the latest patched version to safeguard their applications. Implementing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for mupdf →
FAQ
The vulnerability is a segmentation fault that can be triggered by processing specially crafted PDF files, leading to a Denial of Service.
The vulnerability affects mupdf version 1.24.9 and earlier. Users should upgrade to version 1.25.1+ds1-5 or later.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without any signup.
Exploiting this vulnerability can lead to a Denial of Service, causing the application to crash and become unresponsive.
Yes, avoid opening untrusted PDF files and consider running mupdf in a sandboxed environment to limit exposure to the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for mupdf.
