Heap-based buffer overflow in MuPDF - CVE-2019-13290

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the fz_append_display_node located at fitz/list-device.c, allowing remote attackers to execute arbitrary code via a crafted PDF file with a large BDC property name that overflows the allocated size of a display list node. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

How to mitigate CVE-2019-13290

External References

• http://git.ghostscript.com/?p=mupdf.git;h=aaf794439e40a2ef544f15b50c20e657414dec7a
• http://git.ghostscript.com/?p=mupdf.git;h=ed19bc806809ad10c4ddce515d375581b86ede85
• https://archive.today/oi6bm
• https://bugs.ghostscript.com/show_bug.cgi?id=701118
• https://lists.debian.org/debian-lts-announce/2020/07/msg00019.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VUXKCY35PKC32IFHN4RBUCZ75OWEYVJH/

Related Security Bulletins

• Remote code execution in Artifex MuPDF
• Debian update for mupdf
• Fedora 30 update for mupdf