Stack-based buffer overflow in jstest_main.c in mujstest in Artifex Software, Inc. MuPDF 1.10a allows remote attackers to have unspecified impact via a crafted image.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Stack-based buffer overflow in jstest_main.c in mujstest in Artifex Software, Inc. MuPDF 1.10a allows     remote attackers to have unspecified impact via a crafted image. (CVE-2017-6060)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Stack-based buffer overflow in jstest_main.c in mujstest in Artifex Software, Inc. MuPDF 1.10a allows
    remote attackers to have unspecified impact via a crafted image. (CVE-2017-6060)

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2765 advisory.

    Multiple issues have been discovered in mupdf. CVE-2016-10246 Buffer overflow in the main function in     jstest_main.c allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted     file. CVE-2016-10247 Buffer overflow in the my_getline function in jstest_main.c allows remote attackers     to cause a denial of service (out-of-bounds write) via a crafted file. CVE-2017-6060 Stack-based buffer     overflow in jstest_main.c allows remote attackers to have unspecified impact via a crafted image.
    CVE-2018-10289 An infinite loop in the fz_skip_space function of the pdf/pdf-xref.c file. A remote     adversary could leverage this vulnerability to cause a denial of service via a crafted pdf file.
    CVE-2018-1000036 Multiple memory leaks in the PDF parser allow an attacker to cause a denial of service     (memory leak) via a crafted file. CVE-2020-19609 A heap based buffer over-write in tiff_expand_colormap()     function when parsing TIFF files allowing attackers to cause a denial of service. For Debian 9 stretch,     these problems have been fixed in version 1.14.0+ds1-4+deb9u1. We recommend that you upgrade your mupdf     packages. For the detailed security status of mupdf please refer to its security tracker page at:
    https://security-tracker.debian.org/tracker/mupdf Further information about Debian LTS security     advisories, how to apply these updates to your system and frequently asked questions can be found at:
    https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

fix buffer overflow (#1425338)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201706-08 (MuPDF: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MuPDF. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to process a specially crafted PDF       document or image using MuPDF, possibly resulting in a Denial of Service       condition or have other unspecified impact.
  Workaround :

    There is no known workaround at this time.

Security fix for CVE-2017-5896 CVE-2017-6060

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2017-6060 CVE-2017-5896

----

Add comment with explanation of disabled debuginfo

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
253595	Linux Distros Unpatched Vulnerability : CVE-2017-6060	Nessus	Misc.	high
426906	Alpine: multiple mupdf packages: security update to 1.11-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	high
426906	Alpine: multiple mupdf packages: security update to 1.11-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
405653	Alpine: multiple mupdf packages, py3-mupdf: security update to 1.11-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	high
405653	Alpine: multiple mupdf packages, py3-mupdf: security update to 1.11-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
405652	Alpine: multiple mupdf packages: security update to 1.10a-r3	Tenable Cloud Security	Alpine Linux Local Security Checks	high
405652	Alpine: multiple mupdf packages: security update to 1.10a-r3	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
400858	Alpine: multiple mupdf packages: security update to 1.11-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400858	Alpine: multiple mupdf packages: security update to 1.11-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
153600	Debian DLA-2765-1 : mupdf - LTS security update	Nessus	Debian Local Security Checks	high
101622	Fedora 26 : mupdf (2017-487051ac16)	Nessus	Fedora Local Security Checks	high
100651	GLSA-201706-08 : MuPDF: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
97925	Fedora 24 : mupdf (2017-3b97b275da)	Nessus	Fedora Local Security Checks	critical
97591	Fedora 25 : mupdf (2017-9a819664a6)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2017-6060

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

critical

critical