Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #963368 > unrolled thread

Bug#931475: mupdf: CVE-2019-13290

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#931475: mupdf: CVE-2019-13290 Salvatore Bonaccorso <carnil@debian.org> - 2019-07-05 21:30 +0200
    Bug#931475: mupdf: CVE-2019-13290 Kan-Ru Chen <koster@debian.org> - 2019-07-07 10:10 +0200
      Bug#931475: mupdf: CVE-2019-13290 Salvatore Bonaccorso <carnil@debian.org> - 2019-07-07 11:30 +0200

#963368 — Bug#931475: mupdf: CVE-2019-13290

Source: mupdf
Version: 1.14.0+ds1-4
Severity: important
Tags: security upstream
Forwarded: https://bugs.ghostscript.com/show_bug.cgi?id=701118

Hi,

The following vulnerability was published for mupdf.

CVE-2019-13290[0]:
| Artifex MuPDF 1.15.0 has a heap-based buffer overflow in
| fz_append_display_node located at fitz/list-device.c, allowing remote
| attackers to execute arbitrary code via a crafted PDF file. This
| occurs with a large BDC property name that overflows the allocated
| size of a display list node.

I'm not 100% certain, that the issue is not introduced only after the
current version in unstable, but looking at the code I marked it as
found in 1.14.0+ds1-4 already, let me know if you think this was
wrong. Upstream issue it at [1] with fixes [2] and [3].

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-13290
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13290
[1] https://bugs.ghostscript.com/show_bug.cgi?id=701118
[2] http://git.ghostscript.com/?p=mupdf.git;h=aaf794439e40a2ef544f15b50c20e657414dec7a
[3] http://git.ghostscript.com/?p=mupdf.git;h=ed19bc806809ad10c4ddce515d375581b86ede85

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

[toc] | [next] | [standalone]

#963451

[Multipart message — attachments visible in raw view] — view raw

On Fri, Jul 05, 2019 at 09:19:33PM +0200, Salvatore Bonaccorso wrote:
> Source: mupdf
> Version: 1.14.0+ds1-4
> Severity: important
> Tags: security upstream
> Forwarded: https://bugs.ghostscript.com/show_bug.cgi?id=701118
> 
> Hi,
> 
> The following vulnerability was published for mupdf.
> 
> CVE-2019-13290[0]:
> | Artifex MuPDF 1.15.0 has a heap-based buffer overflow in
> | fz_append_display_node located at fitz/list-device.c, allowing remote
> | attackers to execute arbitrary code via a crafted PDF file. This
> | occurs with a large BDC property name that overflows the allocated
> | size of a display list node.
> 
> I'm not 100% certain, that the issue is not introduced only after the
> current version in unstable, but looking at the code I marked it as
> found in 1.14.0+ds1-4 already, let me know if you think this was
> wrong. Upstream issue it at [1] with fixes [2] and [3].

I can't reproduce with 1.14.0+ds1-4. However, I'll need to apply the
patches when I upload 1.15.0+ds1-1, so I'll keep this open.

Kanru

[toc] | [prev] | [next] | [standalone]

#963461

Hi Kanru,

On Sun, Jul 07, 2019 at 04:51:55PM +0900, Kan-Ru Chen wrote:
> On Fri, Jul 05, 2019 at 09:19:33PM +0200, Salvatore Bonaccorso wrote:
> > Source: mupdf
> > Version: 1.14.0+ds1-4
> > Severity: important
> > Tags: security upstream
> > Forwarded: https://bugs.ghostscript.com/show_bug.cgi?id=701118
> > 
> > Hi,
> > 
> > The following vulnerability was published for mupdf.
> > 
> > CVE-2019-13290[0]:
> > | Artifex MuPDF 1.15.0 has a heap-based buffer overflow in
> > | fz_append_display_node located at fitz/list-device.c, allowing remote
> > | attackers to execute arbitrary code via a crafted PDF file. This
> > | occurs with a large BDC property name that overflows the allocated
> > | size of a display list node.
> > 
> > I'm not 100% certain, that the issue is not introduced only after the
> > current version in unstable, but looking at the code I marked it as
> > found in 1.14.0+ds1-4 already, let me know if you think this was
> > wrong. Upstream issue it at [1] with fixes [2] and [3].
> 
> I can't reproduce with 1.14.0+ds1-4. However, I'll need to apply the
> patches when I upload 1.15.0+ds1-1, so I'll keep this open.

Right, I was as well not able to directly reproduce the issue, though
it might be applicable as well for the 1.14.0 series and older as the
code is very similar, might just not be triggered with the poc itself.

Thank you for already having looked into it!

Regards,
Salvatore

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web