| Vulnerability Name: | CVE-2016-8674 (CCN-122348) | ||||||||||||||||||||||||||||||||||||||||||||||||
| Assigned: | 2016-09-22 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Published: | 2016-09-22 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Updated: | 2017-11-04 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Summary: | The pdf_to_num function in pdf-object.c in MuPDF before 1.10 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted file. | ||||||||||||||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) 4.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
3.8 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
| ||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-416 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Denial of Service | ||||||||||||||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2016-8674 Source: CONFIRM Type: Issue Tracking, Patch, Third Party Advisory http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=1e03c06456d997435019fb3526fa2d4be7dbc6ec Source: CCN Type: MuPDF Web site MuPDF Source: DEBIAN Type: UNKNOWN DSA-3797 Source: CCN Type: oss-sec Mailing List, Sat, 15 Oct 2016 22:41:07 -0400 (EDT) Re: mupdf: use-after-free in pdf_to_num (pdf-object.c) Source: MLIST Type: Mailing List, Patch, Third Party Advisory [oss-security] 20161015 Re: mupdf: use-after-free in pdf_to_num (pdf-object.c) Source: BID Type: Third Party Advisory, VDB Entry 93127 Source: CCN Type: BID-93127 MuPDF 'pdf-object.c' Use After Free Denial of Service Vulnerability Source: MISC Type: Patch, Third Party Advisory, VDB Entry https://blogs.gentoo.org/ago/2016/09/22/mupdf-use-after-free-in-pdf_to_num-pdf-object-c/ Source: CONFIRM Type: Issue Tracking, Patch https://bugs.ghostscript.com/show_bug.cgi?id=697015 Source: CONFIRM Type: Issue Tracking, Patch https://bugs.ghostscript.com/show_bug.cgi?id=697019 Source: CONFIRM Type: Issue Tracking, Patch https://bugzilla.redhat.com/show_bug.cgi?id=1385685 Source: XF Type: UNKNOWN mupdf-cve20168674-dos(122348) Source: CCN Type: WhiteSource Vulnerability Database CVE-2016-8674 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||||||||||||||