Description
In Artifex MuPDF 1.14.0, svg/svg-run.c allows remote attackers to cause a denial of service (recursive calls followed by a fitz/xml.c fz_xml_att crash from excessive stack consumption) via a crafted svg file, as demonstrated by mupdf-gl.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mupdf | 1.15.0+ds1-1 | — |
| Debian 13 | mupdf | 1.15.0+ds1-1 | — |
| Debian 12 | mupdf | 1.15.0+ds1-1 | — |
References
- https://bugs.ghostscript.com/show_bug.cgi?id=700442
- https://github.com/TeamSeri0us/pocs/tree/master/mupdf/20181203
- FEDORA-2019-befe3bd225 vendor-advisory
- FEDORA-2019-15af6a9a07 vendor-advisory
- https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=c8f7e48ff74720a5e984ae19d978a5ab4d5dde5b