CVE-2016-8674

Published: Feb 15, 2017Modified: May 13, 2026

5.5

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

The pdf_to_num function in pdf-object.c in MuPDF before 1.10 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted file.

Affected (1)

Products: Artifex: Mupdf

Artifex

1 product

Mupdf

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Artifex Mupdf	Up to 1.9a

Related CWEs

CWE-416

Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (16)

http://git.ghostscript.com/?p=mupdf.git%3Ba=commitdiff%3Bh=1e03c06456d997435019fb3526fa2d4be7dbc6ec

Source: cve@mitre.org

http://www.debian.org/security/2017/dsa-3797

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2016/10/16/8

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

http://www.securityfocus.com/bid/93127

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://blogs.gentoo.org/ago/2016/09/22/mupdf-use-after-free-in-pdf_to_num-pdf-object-c/

Source: cve@mitre.org

PatchThird Party AdvisoryVDB Entry

https://bugs.ghostscript.com/show_bug.cgi?id=697015

Source: cve@mitre.org

Issue TrackingPatch

https://bugs.ghostscript.com/show_bug.cgi?id=697019

Source: cve@mitre.org

Issue TrackingPatch

https://bugzilla.redhat.com/show_bug.cgi?id=1385685

Source: cve@mitre.org

Issue TrackingPatch

http://git.ghostscript.com/?p=mupdf.git%3Ba=commitdiff%3Bh=1e03c06456d997435019fb3526fa2d4be7dbc6ec