Division by zero in MuPDF - CVE-2023-51104

Vulnerability identifier: #VU118770

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-51104

CWE-ID: CWE-369

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to crash the application.

The vulnerability exists due to a divide by zero error within the pnm_binary_read_image() function in  load-pnm.c. A remote attacker can trick the victim into opening a specially crafted PDF file and crash the application. 

MuPDF
Ubuntu
Anolis OS
mupdf (Ubuntu package)
mupdf
mupdf-devel
mupdf-doc

Install updates from vendor's website.

mupdf (Ubuntu package) - addressed in versions 1.12.0+ds1-1ubuntu0.1~esm2, 1.16.1+ds1-1ubuntu1+esm2, 1.19.0+ds1-2ubuntu0.1~esm1, 1.23.10+ds1-1ubuntu0.1~esm1, 1.25.1+ds1-5ubuntu0.1
mupdf - update to 1.23.2-2
mupdf-devel - update to 1.23.2-2
mupdf-doc - update to 1.23.2-2

• http://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=0c06a4e51519515615f6ab2d5b1f25da6771e1f4
• https://bugs.ghostscript.com/show_bug.cgi?id=707621
• https://github.com/dongyuma/sox-defects/blob/main/mupdf-defects.md

• Multiple DoS vulnerabilities in MuPDF
• Ubuntu update for mupdf
• Anolis OS update for mupdf