CVE-2018-5686: Medium severity Artifex Mupdf vulnerability

Published Jan 14, 2018

Updated

In MuPDF 1.12.0, there is an infinite loop vulnerability and application hang in the pdfparsearray function (pdf/pdf-parse.c) because EOF is not considered. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted pdf file.

Affected Software

4 affected componentsFixes available

debian/mupdf

1.14.0+ds1-4+deb10u31.14.0+ds1-4+deb10u21.17.0+ds1-21.17.0+ds1-1.3~deb11u11.21.1+ds2-11.22.2+ds1-2

Artifex Mupdf=1.12.0

Debian Debian Linux=8.0

Debian Debian Linux=9.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/mupdf to a version that resolves this vulnerability.
Fixed in 1.14.0+ds1-4+deb10u3Fixed in 1.14.0+ds1-4+deb10u2Fixed in 1.17.0+ds1-2Fixed in 1.17.0+ds1-1.3~deb11u1Fixed in 1.21.1+ds2-1Fixed in 1.22.2+ds1-2

Event History

Jan 14, 2018

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Data Sourced

via NVD·02:29 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2018-5686?

CVE-2018-5686 is a vulnerability in MuPDF 1.12.0 that allows remote attackers to cause a denial of service via a crafted pdf file.

What is the severity level of CVE-2018-5686?

The severity level of CVE-2018-5686 is medium with a CVSS score of 5.5.

How can I fix CVE-2018-5686?

To fix CVE-2018-5686, update your MuPDF installation to version 1.14.0 or higher.

Where can I find more information about CVE-2018-5686?

You can find more information about CVE-2018-5686 in the following references: [link1](https://bugs.ghostscript.com/show_bug.cgi?id=698860), [link2](https://lists.debian.org/debian-lts-announce/2019/06/msg00027.html), [link3](https://security.gentoo.org/glsa/201811-15).

What is the CWE classification of CVE-2018-5686?

CVE-2018-5686 is classified as CWE-835.