| Vulnerability Name: | CVE-2017-14687 (CCN-132469) | ||||||||||||||||||||||||||||||||||||||||
| Assigned: | 2017-09-22 | ||||||||||||||||||||||||||||||||||||||||
| Published: | 2017-09-22 | ||||||||||||||||||||||||||||||||||||||||
| Updated: | 2018-02-04 | ||||||||||||||||||||||||||||||||||||||||
| Summary: | Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to "Data from Faulting Address controls Branch Selection starting at mupdf+0x000000000016cb4f" on Windows. This occurs because of mishandling of XML tag name comparisons. | ||||||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) 6.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
2.9 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
| ||||||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-119 | ||||||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Denial of Service | ||||||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2017-14687 Source: CCN Type: mupdf.git Repository Fix 698558: Handle non-tags in tag name comparisons. Source: MISC Type: Patch http://git.ghostscript.com/?p=mupdf.git;h=2b16dbd8f73269cb15ca61ece75cf8d2d196ed28 Source: DEBIAN Type: UNKNOWN DSA-4006 Source: MISC Type: Exploit, Third Party Advisory https://bugs.ghostscript.com/show_bug.cgi?id=698558 Source: XF Type: UNKNOWN artifex-mupdf-cve201714687-dos(132469) Source: MISC Type: Third Party Advisory https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-14687 Source: CCN Type: wlinzi GIT Repository CVE-2017-14691 Source: MLIST Type: UNKNOWN [debian-lts-announce] 20171107 [SECURITY] [DLA 1164-1] mupdf security update Source: CCN Type: WhiteSource Vulnerability Database CVE-2017-14687 | ||||||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||||||