In Artifex MuPDF 1.13.0, the fz_append_byte function in fitz/buffer.c allows remote attackers to cause a denial of service (segmentation fault) via a crafted pdf file. This is caused by a pdf/pdf-device.c pdf_dev_alpha array-index underflow.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Artifex MuPDF 1.13.0, the fz_append_byte function in fitz/buffer.c allows remote attackers to cause a     denial of service (segmentation fault) via a crafted pdf file. This is caused by a pdf/pdf-device.c     pdf_dev_alpha array-index underflow. (CVE-2018-16648)

Note that Nessus relies on the presence of the package as reported by the vendor.

Several issues have been found in mupdf, a lightweight PDF viewer.

The issues could be exploited by crafted PDF files that result in denial of service by heap-based buffer overflows, segmentation faults or out of bound reads.

For Debian 9 stretch, these problems have been fixed in version 1.9a+ds1-4+deb9u5.

We recommend that you upgrade your mupdf packages.

For the detailed security status of mupdf please refer to its security tracker page at: https://security-tracker.debian.org/tracker/mupdf

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

rebase and bugfixes

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
253596	Linux Distros Unpatched Vulnerability : CVE-2018-16648	Nessus	Misc.	medium
138912	Debian DLA-2289-1 : mupdf security update	Nessus	Debian Local Security Checks	high
120623	Fedora 29 : mupdf (2018-93558de1ac)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2018-16648

medium

Tenable Plugins

medium

high

medium