Use-after-free vulnerability in the pdf_load_xref function in pdf/pdf-xref.c in MuPDF allows remote attackers to cause a denial of service (crash) via a crafted PDF file.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Use-after-free vulnerability in the pdf_load_xref function in pdf/pdf-xref.c in MuPDF allows remote     attackers to cause a denial of service (crash) via a crafted PDF file. (CVE-2016-6265)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Use-after-free vulnerability in the pdf_load_xref function in pdf/pdf-xref.c in MuPDF allows remote
    attackers to cause a denial of service (crash) via a crafted PDF file. (CVE-2016-6265)

  - Heap-based buffer overflow in the pdf_load_mesh_params function in pdf/pdf-shade.c in MuPDF allows remote
    attackers to cause a denial of service (crash) or execute arbitrary code via a large decode array.
    (CVE-2016-6525)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Use-after-free vulnerability in the pdf_load_xref function in pdf/pdf-xref.c in MuPDF allows remote
    attackers to cause a denial of service (crash) via a crafted PDF file. (CVE-2016-6265)

  - Heap-based buffer overflow in the pdf_load_mesh_params function in pdf/pdf-shade.c in MuPDF allows remote
    attackers to cause a denial of service (crash) or execute arbitrary code via a large decode array.
    (CVE-2016-6525)

  - The pdf_to_num function in pdf-object.c in MuPDF before 1.10 allows remote attackers to cause a denial of
    service (use-after-free and application crash) via a crafted file. (CVE-2016-8674)

Security fix for CVE-2016-6265

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New release (1.10a). Security fix for CVE-2016-6265

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201702-12 (MuPDF: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MuPDF. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted PDF       document using MuPDF possibly resulting in the execution of arbitrary       code, with the privileges of the process, or a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

Tobias Kortkamp reports :

Heap-based buffer overflow in the pdf_load_mesh_params function in pdf/pdf-shade.c in MuPDF allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a large decode array.

Use-after-free vulnerability in the pdf_load_xref function in pdf/pdf-xref.c in MuPDF allows remote attackers to cause a denial of service (crash) via a crafted PDF file.

Two vulnerabilities were discovered in MuPDF, a lightweight PDF viewer. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2016-6265     Marco Grassi discovered a use-after-free vulnerability     in MuPDF. An attacker can take advantage of this flaw to     cause an application crash (denial-of-service), or     potentially to execute arbitrary code with the     privileges of the user running MuPDF, if a specially     crafted PDF file is processed.

  - CVE-2016-6525     Yu Hong and Zheng Jihong discovered a heap overflow     vulnerability within the pdf_load_mesh_params function,     allowing an attacker to cause an application crash     (denial-of-service), or potentially to execute arbitrary     code with the privileges of the user running MuPDF, if a     specially crafted PDF file is processed.

This update for mupdf fixes the following issues :

Security issues fixed :

  - CVE-2016-6265: Fixed a use-after-free issue     (boo#990195).

ID	Name	Product	Family	Type	Severity
253594	Linux Distros Unpatched Vulnerability : CVE-2016-6265	Nessus	Misc.	Local	medium
401013	Alpine: multiple mupdf packages: security update to 1.9-r3 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
401013	Alpine: multiple mupdf packages: security update to 1.9-r3 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
400964	Alpine: multiple mupdf packages: security update to 1.9-r8 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
400964	Alpine: multiple mupdf packages: security update to 1.9-r8 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
97482	Fedora 24 : mupdf (2017-844445f2aa)	Nessus	Fedora Local Security Checks	Local	medium
97453	Fedora 25 : mupdf (2017-6fe982684d)	Nessus	Fedora Local Security Checks	Local	medium
97255	GLSA-201702-12 : MuPDF: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
93985	FreeBSD : mupdf -- multiple vulnerabilities (47157c14-9013-11e6-a590-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	Local	critical
93134	Debian DSA-3655-1 : mupdf - security update	Nessus	Debian Local Security Checks	Local	critical
92715	openSUSE Security Update : mupdf (openSUSE-2016-926)	Nessus	SuSE Local Security Checks	Local	medium

Detections

Analytics

CVE-2016-6265

medium

Tenable Plugins

medium

critical

critical

critical

critical

medium

medium

critical

critical

critical

medium