mupdf - Security Update
Summary
DLA-1164-1: mupdf - security update. Affects mupdf versions < 0.9-2+deb7u4. Fixed in 0.9-2+deb7u4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mupdf is a lightweight PDF viewer. It provides functionality to view and interact with PDF files. The package is commonly used for rendering and displaying PDF documents. However, it is vulnerable to two security issues.
Vulnerability Detail
The first vulnerability, identified as CVE-2017-14687, allows attackers to cause a denial of service or potentially have other unspecified impacts by exploiting a mishandling of XML tag name comparisons in MuPDF. This vulnerability can be triggered by a crafted .xps file. The second vulnerability, known as CVE-2017-15587, is an integer overflow discovered in the pdf_read_new_xref_section function in pdf/pdf-xref.c. This vulnerability can be exploited to execute arbitrary code or cause a denial of service.
How To Fix
Minimum fixed version
0.9-2+deb7u4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade mupdfTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is essential to apply the recommended package update to mitigate the risks associated with these vulnerabilities.
Conclusion
In conclusion, mupdf is susceptible to two security vulnerabilities (CVE-2017-14687 and CVE-2017-15587) that can lead to denial of service, arbitrary code execution, or other unspecified impacts. To mitigate these risks, it is highly recommended to upgrade your mupdf packages to version 0.9-2+deb7u4 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mupdf →
FAQ
MuPDF is a lightweight PDF viewer used for rendering and displaying PDF documents.
CVE-2017-14687 is a vulnerability in MuPDF that allows attackers to cause a denial of service or potentially have other unspecified impacts by exploiting a mishandling of XML tag name comparisons.
CVE-2017-15587 is an integer overflow vulnerability in MuPDF that can be exploited to execute arbitrary code or cause a denial of service.
To fix these vulnerabilities, upgrade your mupdf packages to version 0.9-2+deb7u4 or later.
There are no known workarounds for these vulnerabilities. It is crucial to apply the recommended package update.
Related vulnerabilities
Recent vulnerabilities recorded for mupdf.
