Description
regexp.c in Artifex Software, Inc. MuJS allows attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to regular expression compilation.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | mupdf | 1.18.0-1.7 | openSUSE-SU-2024:11068-1 |
Advisories 1
- openSUSE-SU-2024:11068-1 mupdf-1.18.0-1.7 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [oss-security] 20170112 Re: CVE Request: MUJS null pointer dereference and Heap buffer overflow write mailing-list
- FEDORA-2017-dc6023e849 vendor-advisory
- [oss-security] 20170112 CVE Request: MUJS null pointer dereference and Heap buffer overflow write mailing-list
- http://git.ghostscript.com/?p=mujs.git%3Bh=fd003eceda531e13fbdd1aeb6e9c73156496e569
- https://bugs.ghostscript.com/show_bug.cgi?id=697381