Heap-based buffer overflow in the pdf_load_mesh_params function in pdf/pdf-shade.c in MuPDF allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a large decode array.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Heap-based buffer overflow in the pdf_load_mesh_params function in pdf/pdf-shade.c in MuPDF allows remote     attackers to cause a denial of service (crash) or execute arbitrary code via a large decode array.
    (CVE-2016-6525)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Use-after-free vulnerability in the pdf_load_xref function in pdf/pdf-xref.c in MuPDF allows remote
    attackers to cause a denial of service (crash) via a crafted PDF file. (CVE-2016-6265)

  - Heap-based buffer overflow in the pdf_load_mesh_params function in pdf/pdf-shade.c in MuPDF allows remote
    attackers to cause a denial of service (crash) or execute arbitrary code via a large decode array.
    (CVE-2016-6525)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Use-after-free vulnerability in the pdf_load_xref function in pdf/pdf-xref.c in MuPDF allows remote
    attackers to cause a denial of service (crash) via a crafted PDF file. (CVE-2016-6265)

  - Heap-based buffer overflow in the pdf_load_mesh_params function in pdf/pdf-shade.c in MuPDF allows remote
    attackers to cause a denial of service (crash) or execute arbitrary code via a large decode array.
    (CVE-2016-6525)

  - The pdf_to_num function in pdf-object.c in MuPDF before 1.10 allows remote attackers to cause a denial of
    service (use-after-free and application crash) via a crafted file. (CVE-2016-8674)

Security fix for CVE-2017-5896 CVE-2017-6060

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2017-6060 CVE-2017-5896

----

Add comment with explanation of disabled debuginfo

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201702-12 (MuPDF: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MuPDF. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted PDF       document using MuPDF possibly resulting in the execution of arbitrary       code, with the privileges of the process, or a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

Tobias Kortkamp reports :

Heap-based buffer overflow in the pdf_load_mesh_params function in pdf/pdf-shade.c in MuPDF allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a large decode array.

Use-after-free vulnerability in the pdf_load_xref function in pdf/pdf-xref.c in MuPDF allows remote attackers to cause a denial of service (crash) via a crafted PDF file.

Two vulnerabilities were discovered in MuPDF, a lightweight PDF viewer. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2016-6265     Marco Grassi discovered a use-after-free vulnerability     in MuPDF. An attacker can take advantage of this flaw to     cause an application crash (denial-of-service), or     potentially to execute arbitrary code with the     privileges of the user running MuPDF, if a specially     crafted PDF file is processed.

  - CVE-2016-6525     Yu Hong and Zheng Jihong discovered a heap overflow     vulnerability within the pdf_load_mesh_params function,     allowing an attacker to cause an application crash     (denial-of-service), or potentially to execute arbitrary     code with the privileges of the user running MuPDF, if a     specially crafted PDF file is processed.

A flaw was discovered in the pdf_load_mesh_params() function allowing out-of-bounds write access to memory locations. With carefully crafted input, that could trigger a heap overflow, resulting in application crash or possibly having other unspecified impact.

For Debian 7 'Wheezy', these problems have been fixed in version 0.9-2+deb7u3.

We recommend that you upgrade your mupdf packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
253615	Linux Distros Unpatched Vulnerability : CVE-2016-6525	Nessus	Misc.	critical
401013	Alpine: multiple mupdf packages: security update to 1.9-r3 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
401013	Alpine: multiple mupdf packages: security update to 1.9-r3 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
400964	Alpine: multiple mupdf packages: security update to 1.9-r8 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
400964	Alpine: multiple mupdf packages: security update to 1.9-r8 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
97925	Fedora 24 : mupdf (2017-3b97b275da)	Nessus	Fedora Local Security Checks	critical
97591	Fedora 25 : mupdf (2017-9a819664a6)	Nessus	Fedora Local Security Checks	critical
97255	GLSA-201702-12 : MuPDF: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
93985	FreeBSD : mupdf -- multiple vulnerabilities (47157c14-9013-11e6-a590-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	critical
93134	Debian DSA-3655-1 : mupdf - security update	Nessus	Debian Local Security Checks	critical
92794	Debian DLA-589-1 : mupdf security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2016-6525

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical