Out-of-bounds write in MuPDF - CVE-2021-37220

Vulnerability identifier: #VU55403

CSH Severity: High

CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-37220

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in the cached color converter. A remote attacker can trigger out-of-bounds write and execute arbitrary code on the target system.

MuPDF
Ubuntu
Fedora
zathura-pdf-mupdf
mupdf (Ubuntu package)
mupdf
python-PyMuPDF

Install update from vendor's website.

zathura-pdf-mupdf - update to 0.3.7-2.fc34
mupdf (Ubuntu package) - addressed in versions 1.7a-1ubuntu0.1~esm1, 1.12.0+ds1-1ubuntu0.1~esm1, 1.16.1+ds1-1ubuntu1+esm1
mupdf - update to 1.19.0-2.fc34
python-PyMuPDF - update to 1.19.1-1.fc34

• https://bugs.ghostscript.com/show_bug.cgi?id=703791
• http://git.ghostscript.com/?p=mupdf.git;h=f5712c9949d026e4b891b25837edd2edc166151f

• Out-of-bounds write in MuPDF
• Fedora 34 update for mupdf, python-PyMuPDF, zathura-pdf-mupdf
• Ubuntu update for mupdf