Detections
Analytics
Alpine: multiple mupdf packages: security update to 1.9-r8 (deprecated)
critical Tenable Self-Hosted Container Security Plugin ID 400964
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- Use-after-free vulnerability in the pdf_load_xref function in pdf/pdf-xref.c in MuPDF allows remote
attackers to cause a denial of service (crash) via a crafted PDF file. (CVE-2016-6265)
- Heap-based buffer overflow in the pdf_load_mesh_params function in pdf/pdf-shade.c in MuPDF allows remote
attackers to cause a denial of service (crash) or execute arbitrary code via a large decode array.
(CVE-2016-6525)
- The pdf_to_num function in pdf-object.c in MuPDF before 1.10 allows remote attackers to cause a denial of
service (use-after-free and application crash) via a crafted file. (CVE-2016-8674)
See Also
https://git.alpinelinux.org/aports/commit/?id=1400aa953619f0e209740206eed25c2f0167d21f
https://git.alpinelinux.org/aports/commit/?id=5e7b7fecefc250d393a58cba9ac3b889479be651
Plugin Details
Severity: Critical
ID: 400964
Version: Revision 1.22
Type: Local
Published: 8/16/2023
Updated: 1/17/2024
Supported Sensors: Agentless Assessment
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2016-6525
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 11/24/2016
Vulnerability Publication Date: 7/21/2016