CVE-2018-1000039

Опубликовано: 24 мая 2018

Источник: nvd

CVSS3: 7.8

CVSS3: 6.3

CVSS2: 6.8

EPSS Низкий

Описание

In Artifex MuPDF 1.12.0 and earlier, multiple heap use after free bugs in the PDF parser could allow an attacker to execute arbitrary code, read memory, or cause a denial of service via a crafted file.

Ссылки

http://git.ghostscript.com/?p=mupdf.git%3Ba=commitdiff%3Bh=4dcc6affe04368461310a21238f7e1871a752a05%3Bhp=8ec561d1bccc46e9db40a9f61310cd8b3763914e
http://git.ghostscript.com/?p=mupdf.git%3Ba=commitdiff%3Bh=71ceebcf56e682504da22c4035b39a2d451e8ffd%3Bhp=7f82c01523505052615492f8e220f4348ba46995
http://git.ghostscript.com/?p=mupdf.git%3Ba=commitdiff%3Bh=f597300439e62f5e921f0d7b1e880b5c1a1f1607%3Bhp=093fc3b098dc5fadef5d8ad4b225db9fb124758b
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5492
Exploit
Issue Tracking
Patch
Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5513
Exploit
Issue Tracking
Patch
Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5521
Exploit
Issue Tracking
Patch
Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5604
Exploit
Issue Tracking
Third Party Advisory
https://bugs.ghostscript.com/show_bug.cgi?id=698883
https://bugs.ghostscript.com/show_bug.cgi?id=698888
https://bugs.ghostscript.com/show_bug.cgi?id=698891
https://bugs.ghostscript.com/show_bug.cgi?id=698892
https://bugs.ghostscript.com/show_bug.cgi?id=698901
https://security.gentoo.org/glsa/201811-15
Third Party Advisory
http://git.ghostscript.com/?p=mupdf.git%3Ba=commitdiff%3Bh=4dcc6affe04368461310a21238f7e1871a752a05%3Bhp=8ec561d1bccc46e9db40a9f61310cd8b3763914e
http://git.ghostscript.com/?p=mupdf.git%3Ba=commitdiff%3Bh=71ceebcf56e682504da22c4035b39a2d451e8ffd%3Bhp=7f82c01523505052615492f8e220f4348ba46995
http://git.ghostscript.com/?p=mupdf.git%3Ba=commitdiff%3Bh=f597300439e62f5e921f0d7b1e880b5c1a1f1607%3Bhp=093fc3b098dc5fadef5d8ad4b225db9fb124758b
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5492
Exploit
Issue Tracking
Patch
Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5513
Exploit
Issue Tracking
Patch
Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5521
Exploit
Issue Tracking
Patch
Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5604
Exploit
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:artifex:mupdf:*:*:*:*:*:*:*:*

Версия до 1.12.0 (включая)

EPSS

Процентиль: 72%

0.00705

Низкий

7.8 High

CVSS3

6.3 Medium

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-416

Связанные уязвимости

CVE-2018-1000039

CVSS3: 6.3

ubuntu

больше 7 лет назад

CVE-2018-1000039

CVSS3: 6.3

debian

больше 7 лет назад

In Artifex MuPDF 1.12.0 and earlier, multiple heap use after free bugs ...

GHSA-mv25-m6g9-hcg7

CVSS3: 7.8

github

больше 3 лет назад

In MuPDF 1.12.0 and earlier, multiple heap use after free bugs in the PDF parser could allow an attacker to execute arbitrary code, read memory, or cause a denial of service via a crafted file.

EPSS

Процентиль: 72%

0.00705

Низкий

7.8 High

CVSS3

6.3 Medium

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-416