Main Vulnerability Database Vulnerabilities #VU15727

Assertion failure in MuPDF - CVE-2018-1000037

Published: November 6, 2018

Vulnerability identifier: #VU15727

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-1000037

CWE-ID: CWE-617

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to multiple reachable assertions in the PDF parser. A remote attacker can trick the victim into opening a specially crafted PDF document, trigger assertion failure and cause the service to crash.

Affected software

MuPDF
Debian Linux

How to mitigate CVE-2018-1000037

Update to version 1.14.0.

MuPDF - update to 1.14.0

External References

http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=71ceebcf56e682504da22c4035b39a2d451e8ffd;hp=7f82c01523505052615492f8e220f4348ba46995

Related Security Bulletins